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SPECIFICATION 



TAG PRIVACY PROTECTION METHOD, TAG DEVICE, 
BACKEND APPARATUS, UPDATER, UPDATE SOLICITOR, 
5 PROGRAMS THEREFOR AND RECORD MEDIUM 

CARRYING SUCH PROGRAMS IN STORAGE 



TECHNICAL FIELD 

[0001] The present invention relates to a tag technology incorporating 
10 information security technology, in particular, to a method of protecting tag 
privacy against acquisition of a user privacy information from information 
delivered from a tag device, a tag device, a backend apparatus, an updater, an 
update solicitor, programs therefor and a record medium carrying such 
programs in storage. 
1 5 BACKGROUND ART 

[0002] Recently an automatic tag identification system such as RFID (Radio 
Frequency Identification) is increasingly introduced. The system comprises an 
information record medium of a small size referred to as "tag device", a 
reading machine referred to as "reader" and a database server referred to as 
20 "backend apparatus", and is utilized in controlling the distribution of articles. 
A summary of this technology will be given below. 
[Processing by tag device] 

In a basic automatic tag identification system, each tag device has a 
tag ID information which is inherent thereto (for example, a tag ID as 
25 prescribed by Auto-ID center of MIT comprises a manufacturer code, a goods 
code indicating the variety of goods and a serial number indicating the 
number of a particular one of goods) in storage therein. The tag device is 
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applied to articles or the like, and the tag ID information which is inherent to 
each tag device is transmitted by radio communication to a reader installed in 
a store or the like. 
[0003] [Processing by reader] 
5 A reader reads tag ID information from a tag device through radio 

communication, and sends the tag ID information to a backend apparatus to 
solicit an acquisition of products distribution information. 
[Processing by backend apparatus] 

A backend apparatus controls a database for ID's from each tag 
10 device and for products distribution information or the like. And the backend 
apparatus retrieves products distribution information or the like in the 
database using tag ID information transmitted from the reader as a key and 
transmits a result of retrieval to the reader. 
[0004] [Issues in basic automatic tag identification system] 
15 However, in the basic automatic tag identification system, anyone 

who is in possession of a reader can read tag ID information, and accordingly, 
there has been a risk that information of articles under control may leak 
through eavesdropped tag ID information. 

As regards this, non-patent literature 2 discloses a method in which a 
20 tag device delivers a hash value to a reader. 

According to this method, the tag device initially transmits a hash 
value H(id | r) for a bit combination of ID information id and a random 
number r to the reader, which sends them to the backend apparatus. The 
backend apparatus forms a bit combination of the received random number r 
25 and each id' stored in the database, and determines its hash value H(id* | r). 
Then it verifies whether or not the determined hash value H(id' | r) matches 
with the received hash value H(id | r), and transmits products distribution 

I 
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information or the like which corresponds to the matched id* to the reader. In 
this manner, a leakage of the tag ID information to a third party can be 
prevented. It is to be noted that H(*) means a processing which applies a 

hash function H to * . 
5 [0005] In a method disclosed in Patent Applications No. 2003-1 1 1 342 and 
No. 2003- 11 3 798 which are not yet made open, a privileged ID which makes 
tag ID information confidential is employed to prevent a leakage of tag ID 
information to a third party. Specifically, in these techniques, a privileged ID 
is stored in a tag device, and a client apparatus which has read the privileged 

10 ID solicits a security server apparatus on a network to decrypt the privileged 
ID. In response to the solicitation, the security server apparatus responds with 
a plain text tag ID information which is a decrypted result for the privileged 
ID after it has confirmed that the client is a regular client apparatus. In this 
manner, a leakage of tag ID information to a third party can be prevented. 

15 non-patent literature 1: EPC global. Inc., "EPC global", [online], [retrieved 
September 9, 2004], intemet <http://www.epcglobalinc-org/> . 
non-patent literature 2: Stephen A. Weis, Sanjay E. Sarma, Ronald L. Rivest, 
Daniel W. Engels, Security and Privacy Aspects of Low-Cost Radio 
Frequency Identification Systems, First Intemational Conference on Security 

20 in Pervasive Computing. 

DISCLOSURE OF THE INVENTION 

ISSUES TO BE SOLVED BY THE INVENTION 

[0006] However, with a conventional method, it is possible that a 

distribution process may be traced utilizing information which is delivered 

25 from a tag device. 

Specifically, with the method disclosed in non-patent literature 2, for 
example, a hash value H(id | r) which is transmitted from a tag device to a 
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reader is simply a random number to a third party who does not know id. A 
random number r is generated each time a communication occurs between the 
tag device and the reader, and accordingly, the hash value H(id | r) changes 
from communication to communication. Accordingly, an attacker normally 
5 cannot gain a knowledge of an association between the hash value H(id | r) 
which is eavesdropped from the tag device and a hash value H(id | ri) in a 
history of past communications. However, if an attacker could acquire ID 
information id as by tampering with the tag device, he could then calculate a 
hash value H(id | ri) from the random number r^ in the history of past 

10 communications (if he knows a hash ftinction H). By verifying whether or not 
the calculated value coincides with the hash value (corresponding to the 
random number ri) in the history of past communications, the attacker can 
know whether or not the history of the communications is one which 
corresponds to the acquired ID, and thus can trace a distribution process of the 

15 tag device by collecting the history of communications corresponding to this 
ID. 

[0007] Also in the method disclosed in Patent Application No.2003- 1 1 1 342 
or the like, for example, because the radio tag device always retums a same 
privileged ID, the attacker can trace the distribution process of the tag device 

20 by tracing the privileged ID if he cannot decrypt ID in plain text. 

The present invention has been made in view of such aspect, and has 
for its object the provision of a technology which is capable of preventing a 
tracing of the distribution process of tag device by a third party, 
MEANS TO SOLVE ISSES 

25 [0008] To overcome above issues, a tag device is arranged to have 

privileged information for tag ID information in storage, and it is updated 
by overwriting at a given opportunity. This makes it difficult for an attacker to 
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realize an association between information delivered in the past from a tag 
device and an updated privileged information, leading to a difficulty to trace 
the distribution process of the tag device. 

By way of example, according to a first invention, a confidential 
5 value which corresponds to respective tag ID information is stored in a 

confidential value memory of respective tag devices. In response to an access 
from a reader, an output section of the tag device delivers a tag output 
information which corresponds to the confidential value in the confidential 
value memory. The tag device includes a first calculator, which reads out at 

10 least part of elements of the confidential value in the confidential value 
memory, and which applies a first function, the inverse image of which is 
difficult to obtain, and the confidential value in the confidential value memory 
is updated by overwriting with a result of such calculation. Since the 
confidential value in the confidential value memory is updated by overwriting, 

15 if an attacker acquires a confidential value stored in the confidential value 
memory as by tampering, the updated confidential value does not correspond 
to information which is transmitted from the tag device before the update. 
Since the update is achieved by applying the first function F 1 , the inverse 
image of which is difficult to obtain, it is difficult to obtain the confidential 

20 value before the update from a confidential value which prevails at a certain 
point in time. Accordingly, the attacker cannot know a correspondence 
between the tag device and the history of communications, 
[0009] According to a second invention, for example, in an updater which is 
provided externally of a tag device, privileged ID information stored in the 

25 tag device is updated at a given opportunity into a new privileged ID 
information, an association of which with the original privileged ID 
information is difficult to follow. When the privileged ID information is 



updated in this manner, an attacker cannot know a correspondence between a 
privileged ID information wliich is delivered from the tag device to backend 
apparatus before the update and new privileged ID information after the 
update. Accordingly, the attacker cannot know the correspondence between 
5 the tag device and the history of communications. 
EFFECTS OF THE INVENTION 

[001 0] As mentioned above, according to the present invention, a third party 
cannot know the correspondence between a tag device and a history of 
communications, and accordingly, a tracing of a distribution process of the 
10 tag device by a third party can be prevented. 
BREIF DESCRIPTION OF THE DRAWINGS 

[001 1] [Fig. 1] A is a block diagram illustrating an entire automatic tag 
identification system according to a first mode of carrying out the invention; 
B and C are block diagrams illustrating schematic arrangements of a tag 
15 device and a backend apparatus, respectively; 

[Fig. 2] is an illustration of an overall arrangement of an automatic 
tag identification system of an embodiment 1 ; 

[Fig. 3] is a flow chart for describing processing in the embodiment 

1; 

20 [Fig. 4] is an illustration of an overall arrangement of an automatic 

tag identification system according to an embodiment 2; 

[Fig. 5] is an illustration of an overall arrangement of an automatic 
tag identification system according to an embodiment 3; 

[Fig. 6] is a flow chart for describing processing by a backend 
25 apparatus of the embodiment 3; 

[Fig. 7] is an illustration of an overall arrangement of an automatic 
tag identification system according to an embodiment 4; 
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[Fig. 8] is a flow chart for describing processing by the backend 
apparatus of the embodiment 4; 

[Fig. 9] is an illustration of an overall arrangement of an automatic 
tag identification system of an embodiment 5; 
5 [Fig. 10] A is a flow chart for describing processing by a tag device 

of the embodiment 5, and B is a flow chart for describing processing by a 
backend apparatus of the present embodiment; 

[Fig. 1 1] is an illustration of an overall arrangement of an automatic 
tag identification system of an embodiment 6; 
10 [Fig- 12] is a flow chart for describing processing in the embodiment 

6; 

[Fig. 13] is an illustration of an overall arrangement of an automatic 
tag identification system of an embodiment 7; 

[Fig. 14] is a flow chart for describing processing in the embodiment 

15 7; 

[Fig. 15] is an illustration of an overall arrangement of an automatic 
tag identification system of an embodiment 8; 

[Fig. 16] A is an illustration of data which is stored in the 
confidential value memory of a tag device, and B is an illustration of data 
20 stored in a database memory of a backend apparatus; 

[Fig. 1 7] is a flow chart for describing processing in the embodiment 

8; 

[Fig. 1 8] is a flow chart for describing processing in the embodiment 

8; 

25 [Fig. 19] is an illustration of an overall arrangement of an automatic 

tag identification system of an embodiment 9; 

[Fig. 20] A is an illustration of data stored in the confidential value 
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memory of a tag device, and B is an illustration of data stored in a database 
memory of a backend apparatus; 

[Fig. 21] is an illustration of an overall arrangement of an automatic 
tag identification system of an embodiment 10; 
5 [Fig. 22] is a flow chart for describing processing by a tag device of 

the embodiment 10; 

[Fig. 23] is a flow chart for describing processing by a backend 
apparatus of the embodiment 10; 

[Fig. 24] is an illustration of an overall arrangement of an automatic 
1 0 tag identification system of an embodiment 1 1 ; 

[Fig. 25] is a flow chart for describing processing by a tag device of 
the embodiment 1 1 ; 

[Fig. 26] is a flow chart for describing part of processing by a 
backend apparatus of the embodiment 1 1 ; 
15 [Fig. 27] is a flow chart for describing a processing by a tag device of 

an embodiment 12; 

[Fig. 28] is a block diagram showing a schematic arrangement of a 
second mode for carrying out the invention; 

[Fig. 29] is a conceptual view illustrating an overall arrangement of 
20 an updater system of an embodiment 14; 

[Fig. 30] is a block diagram showing a functional arrangement of an 
updater system of the embodiment 14; 

[Fig. 31] is a flow chart for describing a processing procedure of the 
embodiment 14; 

25 [Fig. 32] is a block diagram showing a functional arrangement of an 

updater system of an embodiment 15; 

[Fig. 33] is a flow chart for describing a processing procedure of the 
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embodiment 15; 

[Fig. 34] is a block diagram showing a functional arrangement of an 
updater system of an embodiment 16; 

[Fig. 35] is a flow chart for describing a processing procedure in the 
5 embodiment 16; 

[Fig. 36] is a block diagram illustrating a functional arrangement of 
an updater system of an embodiment 17; 

[Fig. 37] is a flow chart for describing a processing procedure of the 
embodiment 17; 

10 [Fig- 38] is a conceptual view showing an overall arrangement of an 

updater system of an embodiment 18; 

[Fig, 39] s a block diagram showing a functional arrangement of an 
updater system of the embodiment 18; 

[Fig. 40] is a flow chart for describing a processing procedure of the 
15 embodiment 18; 

[Fig. 41] is a block diagram showing a functional arrangement of an 
updater system of an embodiment 19; 

[Fig. 42] is a flow chart for describing a processing procedure of the 
embodiment 19; 

20 [Fig- 43] is a block diagram showing a functional arrangement of an 

updater system of an embodiment 20; 

[Fig. 44] is a flow chart for describing a processing procedure of the 
embodiment 20; 

[Fig. 45] is a block diagram showing a functional arrangement of an 
25 updater system of an embodiment 21 ; 

[Fig. 46] is a block diagram showing a functional arrangement of an 
updater system of an embodiment 22; 
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[Fig. 47] is a conceptual view illustrating an overall arrangement of 
an updater system of an embodiment 23; 

[Fig. 48] is an illustration of a functional arrangement of the updater 
system of the embodiment 23; 
5 [Fig- 49] is a flow chart for describing a processing procedure of the 

embodiment 23; 

[Fig. 50] is a flow chart for describing a processing procedure of the 
embodiment 23; 

[Fig. 51] is an illustration of a functional arrangement of a security 
10 server apparatus of an embodiment 24; 

[Fig. 52] is an illustration of a format used in the embodiment 24; 

[Fig. 53] is a flow chart for describing a processing procedure of the 
security server apparatus of the embodiment 24; 

[Fig. 54] is an illustration of a functional arrangement of an updater 
15 system of an embodiment 25; 

[Fig. 55] is an illustration of a functional arrangement of an updater 
system of the embodiment 25; 

[Fig. 56] is a flow chart for describing a processing procedure of the 
embodiment 25; 

20 [Fig- 57] is a flow chart for describing a processing procedure of the 

embodiment 25; and 

[Fig. 58] is an illustration of a functional arrangement of a tag device 

in an embodiment 26. 

Description of characters 
25 [0012] 1 automatic tag identification system 

10 tag device 

1 1 confidential value memory 
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BEST MODES FOR CARRYING OUT THE INVENTION 
[0013] Several modes for carrying out the present invention will be 
described below with reference to the drawings. 
25 [First mode] 

<arrangement> 

Fig. 1 A is a block diagram illustrating an entire automatic tag 



-12- 



identification system 1 according to a first mode. B and C are block diagrams 
illustrating schematic arrangements of a tag device 10 and a backend 
apparatus 30, respectively. 

As illustrated in Fig. 1 A, an automatic tag identification system 1 of 
5 the present mode comprises a tag device 10, a reader 20, and a backend 
apparatus 30 which is connected to the reader 20 through a network 40. 
[0014] As illustrated in Fig. IB, the tag device 10 of the present mode 
comprises a confidential value memory 1 1 in which a confidential value 
corresponding to each tag ID information is stored, a first calculator 12 for 

10 applying a first fixnction Fl, the inverse image of which is difficult to obtain, a 
second calculator 13 for applying a second function F2 which disturbs a 
relationship between elements of a domain of definition and its mapping 
and an output section 14 for delivering tag output information which 
corresponds to a confidential value in the confidential value memory 1 1 to the 

15 backend apparatus 30. 

As illustrated in Fig. IC, the backend apparatus 30 of the present 
mode comprises a database memory 3 1 containing respective tag ID 
information and corresponding confidential values in a manner relating to 
each other, an input section 32 for accepting an input of tag output 

20 information, a calculator 33 for applying the first fiinction Fl and the second 
fijnction F2, a comparator 34 for comparing a result of calculation in the 
calculator 33 against the tag output information, and a read-out section 35 for 
extracting information from the database memory 3 1 . 
[00 1 5] <processing by the tag device 1 0> 

25 When the tag device 1 0 receives a read-out demand from the reader 

20, the second calculator 13 of the tag device 10 initially reads out a 
confidential value from of the confidential value memory 1 1 , and generates 
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the tag output information which is obtained by applying the second function 
F2 thereto. This tag output information is deUvered to the output section 14 
where it is delivered (by either radio or wire communication) to the backend 
apparatus 30. Subsequently, the first calculator 12 reads out at least part of the 
5 elements of the confidential value fi-om the confidential value memory 11, 
applies the first fimction Fl thereto, and updates the confidential value in the 
confidential value memory 1 1 by overwriting with a result of such calculation. 
While the confidential value in the confidential value memory 1 1 is updated 
by overwriting after the tag output information has been generated, an 
10 arrangement may be such that the tag output information is generated after the 
confidential value in the confidential value memory 1 1 is updated by the 
overwriting. 

[00 1 6] <processing by the reader 20> 

The reader 20 accepts an input of the tag output information which is 
15 delivered fi-om the tag device 10 to the backend apparatus 30, and transmits it 
to the backend apparatus 30 through the network 40. 

<processing by the backend apparatus 30> 

The input section 32 of the backend apparatus 30 accepts an input of 
the tag output information which is transmitted fi"om the reader 20. This 

20 triggers the calculator 33 to apply the first fiinction Fl used in the tag device 
10 some number of times to elements which represent at least part of the 
confidential value in the database memory 3 1 and also to apply the second 
fiinction F2 used in the tag device 10. Result of calculation in the calculator 
33 are successively compared against the tag output information in the 

25 comparator 34, and when a matching therebetween is found, the read-out 

section 35 extracts the tag ID information which is related to the confidential 
value which corresponds to the matched result of calculation fi-om the 
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database memory 3 1 . 
[0017] [Embodiment 1] 

Fig. 2 illustrates an overall arrangement of an automatic tag 
identification system 100 in an embodiment 1 according to the first mode, and 
5 Fig. 3 is a flow chart for describing processing in the embodiment 1 . 

Referring to these Figures, the functional arrangement and a method 
of processing in the embodiment 1 will be described below. 

<arrangement> 

As illustrated in Fig, 2, the automatic tag identification system 100 of 

10 the embodiment 1 comprises a tag device 1 10, a reader 120 and a backend 

apparatus 130 which is connected to the reader 120 through a network 140 so 
as to be capable of communication therewith. While in Fig. 2, only one tag 
device 1 10 is shown for purpose for simplifying the description, it should be 
noted that more tag devices exist in actuality. In addition, while one reader 

15 120 and one backend device 130 are shown in Fig. 2, more readers 120 and 
backend apparatus 130 may be used to construct the present system. 
[0018] <tagdevice> 

The tag 110 device in this example comprises a confidential value 
memory 1 1 1, a hash calculator 112 (equivalent to "second calculator"), a hash 

20 calculator 113 (equivalent to "first calculator"), an interface 114 (equivalent 
to "output section"), and a controller 115 including a memory 115a. 

It is to be noted that the confidential value memory 111 and the 
memory 1 15a are memories capable of read/write operation such as EEPROM 
(Electronically Erasable and Programmable Read Only Memory), FeRAM 

25 (Ferroelectric Random Access Memory), a flash memory, NV (Nonvolatile) 
RAM or the like, for example. 

[0019] The hash calculator 112 and the hash calculator 113 are integrated 
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circuits constructed to apply one way functions or hash functions Q H:{0, 
1 }*— >{0, 1 }^ to input values, for example, and to deliver results obtained. It is 
to be noted that (0, 1 }* represents a set of all binary series and (0, 1 }^ 
represents a set of binary series having an L-bit length. Such hash functions Q 
5 H can be illustrated by SHA-1, MD5 or the like. It is to be noted that the hash 
function H is equivalent to "a first function Fl, the inverse image of which is 
difficult to obtain", and the hash function G is equivalent to "a second 
function F2 which disturbs a relationship between elements of a domain of 
definition and its mapping". It is also to be noted that the controller 115 is an 
10 integrated circuit constructed so as to control processing of the entire tag 
device 110. 

[0020] The interface 114 is a hardware which delivers data to the reader 120 
by radio or wire communication, for example. Specifically, the interface 114 
comprises an encoder/decoder circuit which performs an encoding/decoding 

1 5 using NRZ code, Manchester encoding, Miller code, single polarity RZ 
encoding or the like, a modulation/demodulation circuit which performs a 
modulation/demodulation by using the ASK (Amplitude Shift Keying), PSK 
(Phase Shift Keying), FSK (Frequency Shift Keying) or the like, and an 
antenna such as a dipole antenna, a microstrip antenna, a loop antenna or a 

20 cored coil to perform a transmission and reception of a signal using frequency 
in a low frequency band or ISM band (Industry Science Medical band). It is to 
be noted that the communication system utilizes the electromagnetic 
induction system or radio wave system. 

[0021] The hash calculator 112 and the hash calculator 113 are electrically 
25 connected to the confidential value memory 111, and the hash calculator 112 
is electrically connected to the interface 114 (equivalent to "output section"). 
While omitted from illustration in this Figure, the controller 1 1 5 is electrically 
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connected to various portions of the tag device 110. 
<reader> 

The reader 120 in this example comprises a products distribution 
information memory 121, an interface 122, a communication section 123, a 
5 memory 124a, and a controller 124. 

[0022] The products distribution information memory 121 comprises a 
magnetic recorder such as a hard disc unit, flexible disc, or the like, an optical 
disc unit such as DVD-RAM (Random Access Memory), CD-R (Recordable) 
/RW (Rewritable) or the like, a magneto-optical recorder such as MO 

10 (Magneto-Optical disc), a semiconductor memory such as EEP-ROM 

(Electronically Erasable and Programmable-Read Only Memory), a flash 
memory or the like, for example. The interface 122 is a hardware which is 
similar to the example of the interface 114, for example. The communication 
section 123 comprises a LAN card, modem, a terminal adapter or the like, for 

15 example, and the controller 124 comprises CPU (Central Processing Unit) of 
CISC (Complex Instruction Set Computer) type, RICS (Reduced Instruction 
Set Computer) type or the like and including the memory 124a. 
[0023] The interface 122 and the products distribution information memory 
121 are electrically connected to the communication section 123, and while 

20 omitted from illustration in this Figure, the controller 124 is electrically 
connected to various portions of the reader 120. 
<backend apparatus> 

The backend apparatus 130 in this example comprises a database 
memory 131, a communication section 132 (equivalent to "input section")? a 
25 hash calculator 133 (equivalent to "third calculator"), a comparator 134, a 

read/write section 135 (equivalent to "read-out section"), a memory 136a and 
a controller 136. Specifically, the backend apparatus 130 is constructed by the 
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execution of a given program by a known computer of Neumann type 
including CPU, RAM, ROM (Read Only Memory), an extemal memory such 
as a magnetic recorder, an optical disc unit or the like, a LAN card, a modem, 
a terminal adapter or the like, which are connected together by buses. The 
5 CPU reads out a program stored in the RAM and executes a processing 

operation in accordance therewith to implement processing functions which 
are indicated below. 
[0024] <pre-processing> 

A given program is installed into the backend apparatus 130 so that 

10 the hash calculator 133 of the backend apparatus 130 can use the same hash 
functions G and H as contained in the tag device 110. 

A confidential value Sk, i (equivalent to "first confidential value'') 
which corresponds to each tag ID information idk(kG {1, . . m} where k 
corresponds to each tag device and m a total number of tag devices) is stored, 

15 one each, in the confidential value memory 1 1 1 of each tag device 110. The 
confidential value Sk, i is a pseudo-random number Sk, i e {0, 1 }^ which is 
generated by a random number generator (not shovvni) which is provided 
extemally of the tag device 110, for example, in accordance with 
pseudo-random number generating algorithm which is based on a computer 

20 theory which uses a one-way hash function such as SHA-1 or the like. It is 
assumed that the random numbers s^, i which are stored in different tag 
devices are mutually non-coincident. A confidential value Sn, i (equivalent to 
"second confidential value", ne { 1, . . ., m} and n corresponds to k) 
corresponding to each tag device n, tag ID information idn and data such as 

25 products distribution information datan are stored in the database memory 131 
of the backend apparatus 130 in a manner relating to each other. 
[0025] <processing by tag device> 
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Processings which occur when the tag device 1 10 is read by the 
reader 120 at an i-th run (where i is a natural number) will be described below. 
It is to be noted that the processing by the tag device 110 takes place under 
the control of the controller 115, and data which is necessary for the control is 
5 sequentially read and written from or into the memory 1 15a. 

Initially, in the hash calculator 112, a confidential value Sk, i 
(equivalent to "first confidential value") is read from the confidential value 
memory 111 (step SI), and its hash value or tag output information G(s^ \ ) is 
generated (step S2). This tag output information G(Sk, i ) is sent to the interface 
10 114 where it is transmitted to the reader 120 by either radio or wire 
communication (step S3). 

[0026] Next, in the hash calculator 1 13, a hash value Sk, i+i=H(Sk, i) of the 
confidential value Sk, i which is read from the confidential value memory 111 
is calculated (step S4), and the hash value Sk, i+i is saved in the confidential 

15 value memory 1 1 1 by overwriting as a new confidential value Sk, i+i 

(equivalent to "new first confidential value"). (The confidential value Sk, i in 
the confidential value memory 1 1 1 is erased, and instead the confidential 
value Sk, i+i is stored: step S5.) It is to be understood that H(*) implies a 
processing operation which applies the hash fimction H to *. 

20 <processing by the reader> 

The processing by the reader 120 takes place under the control of the 
controller 124, and data which is necessary for the control is sequentially read 
from or written into the memory 124a. 

[0027] Initially, the interface 122 of the reader 120 receives tag output 
25 information G(sk, i) transmitted from the tag device 110 (step S6), and sends it 
to the communication section 123. The communication section 123 extracts 
products distribution information pd (such as a store code where the reader 
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120 is installed, for example) from the products distribution information 
memory 121 (step S7), and transmits the products distribution information pd 
together with the tag output information G(Sk, i) to the backend apparatus 130 
through the network 140 (step S8). 
5 <processing by the backend apparatus> 

Processing by the backend apparatus 130 takes place under the 
control of the controller 136, and data which is necessary for the control is 
sequentially read and written from and into the memory 136a. 
[0028] Initially, the communication section 132 of the backend apparatus 

10 130 receives the products distribution information pd and tag output 

information G(sk, i ) transmitted by the reader 120 (accepts inputs: step S9). 
The received products distribution information pd and tag output information 
G(Sk, i) are stored in the memory 136a. Next, the controller 136 enters 1 for n, 
which is then stored in the memory 136a (step SIO). The controller 136 then 

15 causes the hash calculator 133 to extract a confidential value s„ , from the 

database memory 131 while referring to n value in the memory 136a (step 
SI 1). The controller 136 then enters 0 for j, which is then stored in the 
memory 136a (step SI 2). The controller 136 then refers to j value in the 
memory 136a and causes the hash calculator 133 to calculate a hash value 
20 G(H'(Sn, i)) (equivalent to "result of calculation in the third calculator") (step 
SI 3). It is to be noted that H^(Sn, i) implies applying the hash function H to the 
confidential value s„ , j times. H^(Sn, i) implies s„ j . 

[0029] Subsequently, in the comparator 134, the hash value G(H*(Sn, i)) is 
acquired from the hash calculator 133 and the tag output information G(Sk, i) is 
25 acquired from the memory 136a, and the comparator 134 compare them 
against each other (step SI 4). 

When these values do not match (step SI 5), the controller 136 enters 
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j+1 for j in the memory 136a (step SI 6), and determines whether or not j has 
exceeded a given maximum value jmax (step SI 7). When j is equal to or less 
than the maximum value j max, the controller 136 causes the processings which 
start with the step S 13 to be executed again, and when j exceeds the 
5 maximum value jmax? it determines whether or not n in the memory 136a is 
equal to m (step SI 8). If n=m does not apply, the controller 136 causes n+1 to 
be stored for n in the memory 136a (step SI 9), and causes the processings 
which start with step S 1 1 to be executed again, and terminate the processings 
if n=m. It is to be noted that such processing is equivalent to executing the 
10 processings in the hash calculator 133 and the comparator 134 again by 

changing the value of at least one of n and j under the control of the controller 
136 when the tag output information G(Sk, 0- and the hash value G(H^(Sn, i)) do 
not match. 

[0030] On the other hand, in the event the tag output information G(Sk, i ) 
15 and the hash value G(H'(Sn, i)) match (step SI 5), the controller 136 sends the 
confidential value Sn, i corresponding to the matched hash value G(H^(Sn, i)) to 
the read/write section 135, which then extracts tag ID information idn and data 
such as products distribution information datan which are related to the 
confidential value Sn, i corresponding to the matched hash value G(H'(Sn, i)) 
20 from the database memory 131 and sends them to the communication section 
132 (step S20). The read/write section 135 receives the products distribution 
information pd from the memory 136a and writes it into the database memory 
131 in a manner relating to the confidential value Sn, i (step S20). 
[003 1] The tag ID information idn and the data datan sent to the 
25 communication section 132 are transmitted to the reader 120 through the 

network 140 (step S21), and are received by the communication section 123 
of the reader 120 to be delivered (step S22). 
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<features of embodiment 1> 
[impossibility of tracing] 

In the embodiment 1 of the present mode, the hash value G(Sk, i) is 
used in the communication as a tag output information. On account of the 
5 incapability of recognizing a hash value, this hash value G(Sk, i) appears to be 
a random number simply for an attacker who does not know a confidential 
value. Accordingly, this attacker cannot know whether or not G(sk, i) and G(Sk, 
i+i) are delivered from the same tag device 110, and therefore, cannot trace the 
distribution process of the tag device 110. 
10 [0032] [forward security] 

In the embodiment 1 of the present mode, the confidential value in 
the confidential value memory 111 which is used in the communication is 
arranged to be updated in accordance with a hash function H. If the tag device 
1 10 is subjected to a tampering to leak the confidential value Sk, i, the attacker 
15 cannot determine the past confidential value Sk, i-Ai from the confidential value 
Sk, i because of the one-way nature of the hash function. Accordingly, if the 
confidential value Sk, i leaks, the attacker cannot find a correspondence 
between the acquired confidential value Sk, i and the history of 
communications, and hence cannot trace the tag device 110. 
20 [0033] [traceability] 

On the other hand, on account of the difficulty of collisions between 
the hash functions G and H (the property that hash values for different values 
hardly assume a same value), the backend apparatus 130 which knows the 
confidential value Sn, i can trace the distribution process of the tag device 110. 
25 [efficiency] 

Because only the calculation of hash functions constructs 
communication data, the scale of a circuit which is incorporated in the tag 
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device 1 10 is small as compared with a conventional method of generating 
random numbers, and thus lends itself to an application for which a low price 
is demanded. 

[0034] The hash value H*(Sn, i) which is calculated at step S13 in the 
5 backend apparatus 130 may be recorded in the memory 136 to be utilized at a 
step S13 of the next loop. Specifically, using the recorded H*(Sn, i), a hash 
value H''^^(sn, i) maybe determined by H(H'(Sn, i)), and this value may be 
stored in the memory 136a. In this instance, the number of times the hash 
calculation is made in the hash calculator 133 can be reduced, allowing the 

10 calculation efficiency of the backend apparatus 130 to be improved. 
[0035] [Embodiment 2] 

An embodiment 2 is a modification of the embodiment 1, and differs 
from the embodiment 1 only in respect of the fact that the tag device 
additionally carries tag ID information id^ (equivalent to "first proper value 

15 Wk") to update the confidential value Sj^ i according to Sk, i+i=H(Sk, i | id^). In the 
description to follow, only distinctions over the embodiment 1 will be 
described. 

Fig. 4 illustrates an overall arrangement of an automatic tag 
identification system 200 according to the embodiment 2. It is to be noted that 

20 in this Figure, parts which are common with the embodiment 1 are designated 
by common characters as used in the embodiment 1 . Referring to this Figure, 
the functional arrangement and a processing method of the embodiment 2 will 
be described below. 
[003 6] <pre-processing> 

25 A distinction over the embodiment 1 lies in the fact that tag ID 

information id^ and a corresponding confidential value Sic, i are stored in a 
confidential value memory 211 of a tag device 210. A backend apparatus 130 
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includes a database memory 131 in which a confidential value Sn, i, tag ID 
inforaiation idn and data such as products distribution information datan which 
correspond to each tag device n are stored in a manner relating them to each 
other, and this tag ID information idn is equivalent to "second proper value 

5 Wn". 

< processing by tag device> 

A difference with respect to the embodiment 1 lies only in the 
processing at step S4. Specifically, in place of the processing at the step S4 in 
the embodiment 1, a hash calculator 213 (equivalent to "first calculator") 
10 extracts a confidential value Sk, i and tag ID information idk from a 

confidential value memory 21 1 to calculate s^^ i+i=H(Sk, i | id^). It is to be noted 
that a I p implies a bit combination of a and p. This result of calculation is 
overwritten into the confidential value memory 211 as a confidential value s^, 

15 [0037] <processing by reader> 

This remains to be the same as in the embodiment 1. 
<processing by backend apparatus> 

A difference with respect to the embodiment 1 lies only in the 
processings at steps Sll, S13, and SI 4. Specifically, in the embodiment 2, in 

20 place of step SI 1, a hash calculator 233 (equivalent to "third calculator") of a 
backend apparatus 230 extracts a confidential value Sn, i and corresponding 
tag ID information idn from the database memory 131. 
[0038] Then, in the similar manner as in the embodiment 1, the controller 
136 enters 0 for j, and stores it in the memory 136a (step SI 2). Subsequently, 

25 in place of step S13, the hash calculator 233 calculates a hash value G(I^(n)). 
Here, a definition is made that F(n)=Sn, i G=0), V(n)=H(V'\n) \ idn) G>1)- Thus 
the hash calculator 233 determines P(n) recurrently fi-om the confidential 
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value s„ , and the corresponding tag ID information idn, and calculates its 
hash value G(I^(n)). This recurrent calculation is implemented by temporarily 
storing each P (n) . . j-1 }) appearing in the calculation process in the 

memory 136a to be used in the calculation of next I^^^(n). V(n) which is 
5 obtained when calculating the hash value G(I^(n)) may be saved in the 

memory 136a at least until the next hash value 0(1^"^ \n)) is calculated. In this 
manner, I^(n) which is once obtained can be utilized in the calculation of 
I^^^(n)=H(l\n) I idn) which is used in determining the next hash value 
G(P^^(n)), allowing an improved efficiency of calculation, 

10 [0039] Subsequently, in place of step SI 4, a comparator 134 acquires the 
hash value G(I^(n)) from the hash calculator 233 and tag output information 
G(sk, i) from the memory 136a and compare them against each other. 
Subsequently, the processings at step S15 and subsequent steps are executed 
in the similar manner as in the embodiment 1 . 

15 As described above, in the embodiment 2, the confidential value Sk, i 

in the confidential value memory 2 1 1 of the tag device 210 is updated by a 
calculation Sk, i+i=H(Sic, i | id^). In this manner, a situation that updated contents 
of confidential values which correspond to different tag ID information idk 
may become semi-permanently coincident can be prevented. Specifically, 

20 when the same hash function is applied to different confidential values or the 
like, it is possible that result of these calculations may become coincident at a 
certain point in time (collision). However, even in such instance, tag ID 
information id^ which corresponds to each confidential value s^, i is different, 
and hence a next confidential value which is calculated according to Sk, 

25 i+i=H(Sk, i I idk) cannot be the same. This represents an effect that cannot be 
obtain when a confidential value is updated according to Sk, i+i=H(Sk, i). 
[0040] While tag ID information idk and idn have been used as the first 
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proper value and the second proper value Wn in the embodiment 2, other 
information which corresponds to each tag ID information may be used as a 
proper value. 

[Embodiment 3] 

5 This represents a modification of the embodiment 1 , and the 

difference w^ith respect to the embodiment 1 exists only in recording a 
calculated value G(H*(Sn, i)) (j^O, . . jmax) which is previously calculated in 
the backend apparatus. Only a distinction over the embodiment 1 will be 
described below, 

10 [0041] Fig. 5 is an illustration of an overall arrangement of an automatic tag 
identification system 300 according to an embodiment 3. In this Figure, parts 
which are common to the embodiment 1 are designated by common 
characters as used in the embodiment 1 . Fig. 6 is a flow chart for describing 
processings by a backend apparatus 330 in the embodiment 3. A functional 

1 5 arrangement and the processing method of the embodiment 3 will be 
described below with reference to these Figures. 
<pre-' processing> 

Storing a result of calculation G(HXsn, i)) Q=0, . . jmax) which is 
previously calculated by the hash calculator 133 in a database memory 331 of 
20 the backend apparatus 330 in a manner relating it to the confidential value Sn, i 
represents a sole distinction with the respect to the first mode. 
[0042] <processing by tag device/processing by reader> 

These remain to be similar to the embodiment 1 . 

<processing by backend apparatus> 
25 Initially, the backend apparatus 330 receives the products distribution 

information pd and tag output information G(Sk, j) transmitted fi-om the reader 
120 by means of a communication section 132 (step S3 1). The received 
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products distribution information pd and tag output information G(Sk, i) are 
stored in a memory 136a. A controller 136 then enters 1 for n, and stores it in 
the memory 136a (step S32). The controller 136 then enters 0 for j, and stores 
it in the memory 136a (step S33). The controller 136 extracts a result of 
5 calculation G(H*(Sn, i))stored in a database memory 331 while referring to 
values of n and j in the memory 136a (step S34). 

[0043] Then, a comparator 134 compares this result of calculation G(H^(Sn, 
i)) against the tag output information G(sk, i) which is extracted from the 
memory 136a (step S3 5). 

10 In the event these values do not match (step S36), the controller 136 

enters jH-1 for j in the memory 136a (step S3 7) and determines whether or not 
j has exceeded the given maximum value jmax (step S3 8). If j is less than the 
maximum value jmax^ the controller 136 causes processings at step S34 and 
subsequent steps to be re-executed, and when j exceeds the maximum value 

15 jmaxj it determines whether or not n in the memory 136a is equal to m (step 
S39). If n=m does not apply, the controller 136 stores n<— n+1 (making n+1 to 
be a new n) in the memory 136a (step S40), causes processings at step 33 and 
subsequent steps to be re-executed, and terminates the processing operations 
for n=m. This operation is equivalent to re-executing the processings in the 

20 hash calculator 133 and the comparator 134 by changing the value of at least 
one of n and j under the control of the controller 136 when the tag output 
information G(sk, i) - and the hash value G(H*(Sn, i)) do not match. 
[0044] On the other hand, when the tag output information G(Sk, i) and the 
hash value G(H*(Sn, 0) match (step S3 6), the controller sends the confidential 

25 value Sn, i corresponding to the matched result of calculation G(H^(Sn, i)) to the 
read/write section 135, which extracts the tag ID information idn and data 
datan such as the products distribution information or the like which are 
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related to the confidential value Sn, i which corresponds to the matched hash 
value G(H*(Sn, i)) from the database memory 331 and sends them to the 
communication section 132 (step S40). The read/write section 135 receives 
the products distribution information pd from the memory 136a, and writes 
5 this products distribution information pd into the database memory 1 3 1 by 
relating it to the confidential value Sn, i (step S40). The tag ID information idn 
and the data datan which are sent to the communication section 132 are 
transmitted to the reader 120 through the network 140 (step S41). 
[0045] As described above, in the embodiment 3, an arrangement is made to 
10 store the result of calculation G(H^(Sn, i)) which is previously calculated in the 
database memory 331. Consequently, the amount of a processing in the 
backend apparatus 330 can be reduced as compared with an arrangement in 
which G(H'(Sn, i)) is calculated for each comparing processing. 
[Embodiment 4] 

15 An embodiment 4 is a modification of the embodiment 1, and differs 

from the embodiment 1 only in an arrangement that information specifying a 
number of times a confidential value is updated is transmitted from a tag 
device, and the number of times the confidential value is updated is used in a 
backend apparatus for purpose of processing. Only a distinction over the 

20 embodiment 1 will be described below. 

[0046] Fig. 7 is an illustration of an overall arrangement of an automatic tag 
identification system 400 of the an embodiment 4. In this Figure, parts 
common to the embodiment 1 are designated by common characters as used 
in the embodiment 1 . Fig. 8 is a flow chart for describing processing by a 

25 backend apparatus 430 of the embodiment 4. A functional arrangement and a 
processing method of the embodiment 4 will be described below with 
reference to these Figures. 
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<arrangement of tag device> 

A distinction over the embodiment 1 resides in a provision of a 
counter 416 in a tag device 410 which counts a number of times m a 
confidential value is updated. 
5 [0047] <processing by tag device> 

A distinction over the embodiment 1 resides in only an arrangement 
which stores a number of times m a confidential value Sk, i is updated as 
counted by a counter 416 in a confidential value memory 411 of a tag device 
410 in addition to the confidential value Sk, i and an arrangement by which 
10 information which specifies the number of times m the update is performed is 
transmitted to the reader 120 through a hash calculator 112 and an interface 
114 (equivalent to "output section"). 

<processing by reader> 

A distinction over the embodiment 1 resides only in an arrangement 
15 in which an interface 122 also receives information specifying a number of 
times m the update is performed and a communication section 123 transmits 
information specifying the number of times m the update is performed to the 
backend apparatus 430 through the network 140. 
[0048] <processing by backend apparatus> 
20 Initially, the communication section 132 of the backend apparatus 

330 receives information specifying m, products distribution information pd 
and tag output information G(sk, i) which are transmitted firom the reader 120 
(step S50). Information specifying m, the products distribution information pd 
and the tag output information G(Sk, i) which have been received are stored in 
25 the memory 136a. Then the controller 136 enters 1 for n, and stores it in the 
memory 136a (step S51). The controller 136 then causes a hash calculator 433 
to extract a confidential value Sn, i from the database memory 131 while 
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referring to values of n and j in the memory 136a (step S52), and causes the 
hash function H to be applied thereto m times and also causes the hash 
function G to be applied subsequently, thus allowing a hash value G(H'(Sn, i)) 
(j==m) to be calculated (step S53). 
5 [0049] Then the comparator 134 acquires the hash value G(H'(Sn, i)) from 
the hash calculator 133 and the tag output information G(sk, i) from the 
memory 136a and compare them against each other (step S54). 

In the event these values do not match (step S55), the controller 136 
determines w^hether or not n in the memory 136a is equal to m (step D56). If 

10 n=m does not apply, the controller 136 stores n<— n+1 (making n+l to be a 
new n) in the memory 136a (step S57), causes processings at step S52 and 
subsequent steps to be re-executed and terminates the processing if n=m. It is 
to be noted that this processing is equivalent to re-executing the processings 
in the hash calculator 433 and the comparator 134 by changing the value of n 

15 when the hash value G(H^(Sn, i)) and the tag output information G(Sk, i) do not 
match. 

[0050] On the other hand, if the tag output information G(Sk, i) and the hash 
value G(Sk, i) match (step S55), the controller sends the confidential value Sn, i 
corresponding to the matched hash value G(Sk, i) to the read/v^ite section 135, 

20 which then extracts tag ID information idn and data datan such as products 

distribution information which are related to the confidential value Sn, i which 
corresponds to the matched hash value G(H*(Sn, i)) firom the database memory 
131 and sends them to the communication section (step S58). The 
read/write section 135 receives products distribution information pd fi-om the 

25 memory 136a, and then writes this products distribution information pd into 
the database memory 131 in a manner relating it to the confidential value Sn, i 
(step S59). Tag ID information idn and data datan which are sent to the 
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communication section 132 are transmitted to the reader 120 through the 
network 140 (step S59). 

[0051] As described above, in the embodiment 4, an arrangement is made 
so that the tag device 410 transmits m and the backend apparatus 430 uses 
5 this m to calculate the hash value G(H"^(Sn, i)) for purpose of a comparing 
processing. In this manner, a comparing processing by the backend apparatus 
430 takes place only once for each Sn, i, allowing the amount of the processing 
required to be reduced. 

[Embodiment 5] 

10 An embodiment 5 is a modification of the embodiment 1, and differs 

from the embodiment 1 only in respect of performing an updating/comparison 
of the confidential value using a secret key encrypted function in place of a 
hash function. Only a distinction over the embodiment 1 will be described 
below. 

1 5 [0052] Fig. 9 is an illustration of an overall arrangement of an automatic tag 
identification system 500 of the embodiment 5. It is to be noted that in this 
Figure, parts which are conmion to the embodiment 1 are designated by 
common characters as used in the embodiment 1. Fig. lOA is a flow chart for 
describing processing by a tag device 510 in the embodiment 5, and Fig. lOB 

20 is a flow chart for describing processing by a backend apparatus 530 in the 
embodiment 5. A functional arrangement and a processing method of the 
present embodiment will be described below with reference to these Figures. 
<pre-processing> 

In the embodiment 5, a tag device 5 10 is provided with a key 
25 memory 515, and a backend apparatus 530 is provided with a key memory 
536, each storing common keys KG and KH, respectively. In the tag device 
510, encrypted function calculators 512 and 513 are substituted for the hash 
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calculators 112 and 1 13 of the first embodiment, and in the backend apparatus 
530, an encrypted function calculator 533 is substituted for the hash calculator 
133. The encrypted function calculators 512, 513, and 533 are constructed to 
enable a calculation with a common key encryption function E such as AES, 
5 Camellia or the like in place of the hash function. In the embodiment 5, the 
common key encryption function E which uses the common KH is equivalent 
to "a first function Fl, the inverse image of which is difficult to obtain", and 
the common key encryption function E which uses the common keys KG is 
equivalent to "a second function F2 which disturbs a relationship between 

10 elements of a domain of definition and its mapping". Thus, the first function 
Fl and the second function F2 in this example represent the same common 
key encryption function, to which different common keys are applied. 
[0053] What is mentioned above represents a distinction over the 
embodiment 1. 

1 5 <processing by tag device> 

Initially, an encrypted function calculator 512 (equivalent to "second 
calculator") extracts a confidential value Sk, i fi'om a confidential value 
memory 111 (step S61), extracts a common key KG from a key memory 515, 
and applies a common key encryption function E to the secret key s^, i with the 

20 common key (EKG(Sk, i)' step S62). An encrypted text EKG(Sk, i) which is 
calculated is transmitted as the tag output information EKG(Sk, i) from the 
interface 1 14 to the reader 120 through radio or wire communication (step 
S63). 

[0054] Then, in an encrypted function calculator 513 (equivalent to "first 
25 calculator"), the common key KH is extracted fi-om the key memory 515, the 
confidential value Sk, i is extracted from the confidential value memory 111, 
and the common key encryption function E is applied to the confidential value 
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Sk, i with the common key KH (step 64), and a result of this calculation is 
saved by overwriting as a new confidential value Si4-i=EKH(Sk, 0 in the 
confidential value memory 111 (step 65). 
<processing by reader> 
5 This remains to be similar as in the embodiment 1, 

[0055] <processing by backend apparatus> 

Initially, the backend apparatus 530 receives products distribution 
information pd and tag output information Ekg (sr, i) transmitted by the reader 
120 by the communication section 132 (step S70). Received products 

10 distribution information pd and tag output information Ekg (Sk, i) are stored in 
the memory 136a. Then, the controller 136 enters 1 for n, and stores it in the 
memory 136a (step S71). The controller 136 then causes the encrypted 
function calculator 533 (equivalent to "third calculator") to extract the 
confidential value Sn, i from the database 131 while referring to the value n in 

15 the memory 136a (step S72). The controller 136 then enters 0 for j, and stores 
it in the memory 136a (step S73). The controller 136 causes the encrypted 
function calculator 533 to calculate an encrypted text Ekg (EVh (Sn, 0) 
(equivalent to "result of a calculation in the third calculator") while referring 
to the value of j in the memory 136a (step S74). It should be noted that E^kh 

20 (Sn, i) implies applying a common key encryption function E to the 
confidential value Sn, i j times using the common key KH. Then the 
comparator 134 acquires the encrypted text Ekg (E^kh (Sn, i)) from the hash 
calculator 133 and acquires tag output information tag output information Ekg 
(Sk, i) from the memory 136a, and compare them against each other (step S75). 

25 [0056] In the event these values do not match (step S76), the controller 136 
enters j+1 for j in the memory 136a (step S77), and determines whether not j 
has exceeded a given maximum value jmax (step S78). If it is found that j is 
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equal to or less than the maximum value jmax^ the controller 136 causes 
processings at step S74 and subsequent steps to be re-executed and if j has 
exceeded the maximum value jmax* determines whether or not n in the memory 
136a is equal to m (step S79). If n=m does not apply, the controller 136 saves 
5 n^n+1 (making n+1 to be a mew n) in the memory 136a (step S80), causes 
the processings at step 72 and subsequent steps to be re-executed and 
terminates the processing operation if n=m. It is to be noted that this 
processing is equivalent to re-executing the processings in the encrypted 
function calculator 533 and the comparator 134 by changing the value of at 

10 least one of n and j under the control of the controller 136 when tag output 
information Ekg (Sk, i) and the encrypted text Ekg (E^kh (Sn, i)) do not match. 
[0057] On the other hand, if tag output information Ekg(sic i) and the 
encrypted text Ekg (E^kh (Sn, i)) niatch (step S76), the controller 136 sends the 
confidential value Sn, i which corresponds to the matched encrypted text Ekg 

15 (E-^KH (Sn, i)) to the read/write section 135, which then extracts the tag ID 

information idn and data datan such as products distribution information which 
are related to the confidential value Sn, i which corresponds to the matched 
encrypted text Ekg (E"^kh (Sn, i)) from the database memory 131, and sends 
them to the communication section 132 (step S81). The read/write section 135 

20 receives products distribution information pd fi-om the memory 136a, and 

writes the products distribution information pd into the database memory 131 
by relating it with the confidential value Sn, i (step S81). Tag ID information 
idn and data datan sent to the communication section 132 are transmitted to the 
reader 120 through the network 140 (step S82). 

25 [0058] It is to be noted that the encrypted text E^kh (Sn, i) which is calculated 
at step S74 in the backend apparatus 530 may be recorded in the memory 
136a to be utilized at the step S74 of the next loop. Specifically, using E^h (Sn, 
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i) which is recorded, an encrypted text E-'^Vh (Sn, i) may be determined 
according to Ekh (E^kh (Sn, i)), and this value may be stored in the memory 
136a again. In this instance, a number of times an encrypted calculation is 
performed in the encrypted function calculator 533 can be reduced, improving 
5 the efficiency of the calculation by the backend apparatus 530. Altematively, 
E^KH (Sn, i) G ^ { 1» • • jmax) may be previously calculated in the backend 
apparatus 530 and stored in the memory 136a to be utilized at step S74. Again, 
the efficiency of calculation in the backend apparatus 530 can be improved. 
[0059] While the embodiment 5 represents an example in which processings 

10 are performed by using the common key encryption function E which uses the 
common key KH as "the first function F 1 , the inverse image of which is 
difficult to obtain'' and using the common key encryption function E which 
uses the common key KG as "the second function F2 which disturbs a 
relationship between elements of the domain of definition and its mapping", 

1 5 processings may be performed by using a hash function for one of the first 
function Fl and the second function F2. Also in the embodiments 1 to 4 or 
embodiments 6 to 1 1 which will be described later, processings may be 
performed by using a common key encryption function E which uses a 
common key KH or KG for at least one of the first function Fl and the second 

20 function F2. 

[0060] In this manner, in the embodiment 5, an arrangement is made to 
update a confidential value Sk, [ using a common key encryption function. As a 
consequence, if the confidential value Sk, i leaks from the tag device 510, it is 
impossible for an attacker to trace a distribution process of the tag device 10 
25 on the basis of the confidential value Sk, i and a history of communications. 

Since there is no need to provide a random number generator circuit in the tag 
device 510, a cost required for the tag device 510 can be reduced. In addition. 
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if a common key encryption function which is Hghter (requiring a lesser 
amount of calculations) than a hash function could be used, the amount of 
processings in the tag device 510 and backend apparatus 530 can be reduced. 
[006 1 ] [Embodiment 6] 
5 An embodiment 6 is a modification of the embodiment 1 and differs 

fi-om the embodiment 1 in that a hash value of a bit combination of a 
confidential value Sk, i and a first proper value which is inherent to each tag 
is used as the tag output information. 

Fig. 11 is an illustration of an overall arrangement of an automatic 

10 tag identification system 600 of the embodiment 6, and Fig. 12 is a flow chart 
for describing processing in the embodiment 6. It is to be noted that in Fig. 11, 
parts which are common to the embodiment 1 are designated by common 
characters as used in the embodiment 1 . A functional arrangement and a 
processing method of the embodiment 6 will be described below with 

1 5 reference to these Figures. 
[0062] <pre-processing> 

Differences over the embodiment 1 reside in an arrangement that a 
confidential value s^, i corresponding to each tag ID information idk 
(equivalent to "first confidential value") and a proper value Wk (equivalent to 

20 "the first proper value") are stored in a confidential value memory 61 1 of each 
tag device 610 and an arrangement in which each tag ID information idn 
(ne { 1, . . m}) as well as a confidential value Sn, i (equivalent to "second 
confidential value"), a proper value Wn (equivalent to "second proper value") 
and data datan such as products distribution information which correspond 

25 thereto are stored in a database memory 63 1 of a backend apparatus 630 in a 
maimer relating them to each other. As a proper value, tag ID information 
may be utilized, for example. 
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[0063] <processing by tag device> 

In the following, a processing which occurs when the tag device 610 
is read by a reader 620 during an i-th run (i being a natural number) will be 
described. 

5 Initially, a hash calculator 612 extracts a confidential value Sk, i and a 

proper value Wk from the confidential value memory 611 (step SI 01), and 
calculates tag output information G(Sk, i | Wk) by applying a hash function G to 
a bit combination of the confidential value Sk, i and the proper value Wk (step 
SI 02). The interface 114 transmits this tag output information G(Sk, i | Wk) to 

10 the reader 120 by either radio or wire communication (step SI 03). 

[0064] Then a hash calculator 113 calculates a hash value H(Sk, i) by 
applying the hash function H to confidential value Sk, i which is extracted from 
the confidential value memory 611 (step SI 04), and overwrites the 
confidential value Sk, i in the confidential value memory 611 by a new 

15 confidential value Sk, i+i which is the hash function H(Sk, i) (the confidential 
value Sk, i in the confidential value memory 61 1 is erased and the confidential 
value Sk, i+! is saved instead: step SI 05). 
<processing by reader> 

The reader 120 receives at its interface 122 tag output information 
20 G(Sk, i I Wk) which is transmitted from the tag device 610 (step SI 06) and 
sends it to the communication section 123. The communication section 123 
extracts products distribution information pd from products distribution 
information memory 121 (step SI 07) and transmits the products distribution 
information pd and the hash value G(Sk, i | Wk) to the backend apparatus 630 
25 through the network 140 (step SI 08). 

[0065] <processing by backend apparatus> 

The backend apparatus 630 receives the products distribution 
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information pd and the tag output information G(Sk, i | w^) which are 
transmitted from the reader 120 at its communication section 132 (or accepts 
inputs: step SI 09). The received products distribution information and tag 
output information G(Sk, i | Wk) are stored in a memory 136a. 
5 Then the controller 136 enters 0 for parameters j and n, and store 

them in the memory 136a (step SIO). The controller 136 then refers to j and n 
in the memory 136 and causes a hash calculator 633 (equivalent to "third 
calculator'') to calculate a hash value G(H*(Sn, i) | Wn) using a set of second 
confidential value Sn, i and second proper value Wn which are extracted from 

1 0 the database memory 63 1 (step S 1 1 1 ). It is to be noted this VL\Sn, i) may be 
calculated befrorehand and stored in the database memory 63 1 . In this 
instance, a calculation load of the backend apparatus 630 can be alleviated. 
[0066] Then, a comparator 134 acquires a hash value G(H'(Sn, i) | Wn) from 
the hash calculator 633 and acquires tag output information G(Sk, i | Wk) from 

15 the memory 136a and compare them against each other (step SI 12). 

In the event these values do not match (step SI 13), the controller 136 
enters j+1 for j in the memory 136a (step SI 14), and determines whether or 
not j has exceeded a given maximum value j^ax (step SI 15). If j is equal to or 
less than the maximum value jmax, it retums to the processing at step Sill, but 

20 if j exceeds the maximum value jmax, the controller 136 enters n+1 for n and 0 
for j in the memory 136a (step S116), and determines whether n has exceeded 
a given maximum value nmax (step SI 17). If n is equal to or less than the 
maximum nmax? it retums to the processing at step Sill, but if n exceeds the 
maximum value nmax? an error termination results (step SI 18). 

25 [0067] On the other hand, if a determination at step SI 13 reveals that the tag 
output information G(Sk, \ \ w^) and the hash value G(H*(Sn, i) | Wn) match, the 
controller 136 applies this value of n to the read/write section 135, which uses 
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this n to extract idn and datan which are related to the confidential value Sn, i 
and the proper value Wn which correspond to the matched hash value GCH'Csn, 
i) I Wn) from the database memory 63 1, and send these to the communication 
section 132. The read/write section 135 also receives the products distribution 
5 information pd from the memory 136a, and writes this products distribution 
information pd into the database memory 63 1 in a manner relating it to the 
confidential value Sn, i and the proper value Wn which correspond to the 
matched hash value GCH^Csn, i) | Wn) (step SI 19). 

[0068] idn and datan which are sent to the commutation section 132 are 
10 transmitted to the reader 120 through the network 140, and are received by the 
communication section 123 of the reader 120 to be delivered (step S121). 
<features of embodiment 6> 

In the embodiment 6, tag output information G(Sk, i | Wk) delivered 
from each tag device 610 represents a hash value of a bit combination of the 

15 confidential value s^, i and the proper value w^ which is inherent to each tag 
device 610. The confidential value Sk, i of each tag device is successively 
updated by the hash value H(sk, i). If tag output information G(sk, i | Wk) 
becomes identical between tag devices (occurrence of a collision), because 
the proper value Wk differs between tag devices, this collision can be 

20 eliminated with a high probability due to the difficulty of a collision occurring 
between hash functions if the confidential value Sk, i of each tag device is 
updated. In this manner, a collision between tag output information G(Sk, i | 
Wk) between tag devices 610 can be prevented from occurring in a continued 
manner, thus preventing a failure of the backend apparatus 630 to identify tag 

25 ID information uniquely from the tag output information G(Sk, i | Wk). 
[0069] [Embodiment 7] 

An embodiment 7 is a modification of the embodiment 6, and differs 
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from the embodiment 6 in that tag devices shares a confidential value in 
common. A distinction over the embodiment 1 and embodiment 6 will be 
principally described belov^. 

Fig. 13 is an illustration of an overall arrangement of an automatic 
5 tag identification system 700 of the embodiment 7. It is to be noted that in this 
Figure, parts which are common to the embodiment 1 are designated by 
common characters as used in the embodiment 1. Fig. 14 is a flow chart for 
describing processing in the embodiment 7. A functional arrangement and a 
processing method of the embodiment 7 will be described below with 

10 reference to these Figures. 
[0070] <pre-processing> 

For each ID (id^ (k=l, . . m)) which corresponds to each tag device 
710, a single random number Si g {0, 1 Y is generated, and is stored as a 
confidential value Si (which is an initial value of S\ and is equivalent to " first 

15 confidential value") in the confidential value memory 71 1 of each tag device 
710. For each tag ID information (idk (k=l, . . m)) which corresponds to each 
tag device 710, a proper value Wk which is inherent to each is generated, and 
is stored in the confidential value memory 71 1 of the respective tag device 
710. 

20 [0071] The confidential value Si which is the same as the confidential value 
Si stored in each tag device 710 is stored in a database memory 73 1 of a 
backend apparatus 730 as "second confidential value''. Each proper value Wn 
is also stored the database memory 73 1 in a manner relating it to tag ID 
information idn and datan such as products distribution information or the like 

25 of the corresponding tag device 710. 

In addition, a hash value Sj+2=H'^^(si) (j=0, . . jmax) of the 
confidential value Si which is common to each tag device 710 is calculated by 
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a hash calculator 736 of the backend apparatus 730. Each calculated hash 
value Sj+2 is stored in the database memory 73 1 . 
[0072] <processing by tag device> 

In the following, a processing which takes place during an i-th run 
5 when the tag device is read by a reader 720 will be described. 

Initially, a hash calculator 712 extracts a confidential value S[ and a 
proper value w^ from the confidential value memory 711 (step S13 1), and 
calculates a tag output information G(Si | w^) which is a hash value of a bit 
combination of the confidential value Sj and the proper value w^ (step SI 32). 
10 The interface 114 transmits this tag output information G(Si | w^) to the reader 
120 (step SI 33). 

[0073] A hash calculator 113 then calculates a hash value H(Si) of the 
confidential value Si which is extracted from the confidential value memory 
711 (step SI 34) and the confidential value Sj in the confidential value memory 
15 7 1 1 is overwritten by the hash value H(si) as a new confidential value Si+i 
(step SI 35), 

<processing by reader> 

This remains to be similar to the embodiment 1 (steps S136'-'S138). 
<processing by backend apparatus> 
20 The backend apparatus 730 receives the products distribution 

information pd and tag output information G(Si | Wk) transmitted from the 
reader 120 at its communication section 132 (step S139). The received 
products distribution information pd and tag output information G(Si | Wk) are 
stored in the memory 136a. 
25 [0074] Then the controller 136 enters 0 for parameters j and n and store 
them in the memory 136a (step SI 40). 

In a hash calculator 733 (equivalent to "third calculator"), a hash 
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value G(Sj+i | Wn) is calculated using the proper value Wn and the confidential 
value Si which are extracted from the database memory 73 1 or the hash value 
Sj+2 (which is calculated beforehand by the hash calculator 736) (step S141). 
Then, a comparator 134 acquires the hash value G(Sj+i | Wn) 
5 (equivalent to "result of calculation in the third calculator") from the hash 
calculator 733 and acquires the tag output information G(Si | w^) from the 
memory 136a, and compare them against each other (step SI 42). 
[0075] In the event these values do not match (step S143), the controller 
136 enters j+1 for j in the memory 136a (step SI 44), and determines whether 

10 or not j has exceeded a given maximum value j^ax (step SMS). If j is equal to 
or less than the maximum value jmax? it returns to the processing at step SI 41, 
but if j has exceeded the maximum value jmax^ the controller substitutes n+l 
for n and 0 for j in the memory 136a (step 146) and determines whether or not 
n has exceeded a given maximum value nmax (step SI 47). If n is equal to or 

15 less than the maximum value n^ax^ it retums to the processing at step S141, 
but if n has exceeded the maximum value nmax? an error termination results 
(step SI 48). 

[0076] If the determination at step SI 43 reveals that the tag output 
information G(Si | Wk) and the hash value G(Sj+i | Wn) match, the read/write 

20 section 135 extracts idn and datan which are related to the proper value Wn 
which corresponds to the matched hash value G(Sj+i | Wn) from a database 
memory 73 1 and sends them to the communication section 132 under the 
control of the controller 136. The read/write section 135 also receives 
products distribution information pd from the communication section 132, 

25 and writes the products distribution information pd into the database memory 
73 1 in a manner relating it to the proper value Wn which corresponds to the 
matching hash value G(Sj+i | Wn) (step SI 49). 
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[0077] idn and datan which are sent to the communication section 132 are 
transmitted to the 120 through the network 140 (step SI 50), and are received 
by the communication section 1 23 of the reader 1 20 to be delivered (step 
S151). 

5 <features of embodiment 7> 

In the embodiment 7, the confidential value S\ which is common to 
each tag device 710 is used. Accordingly, the confidential value sj+i which is 
used in the processing at step S141 by the backend apparatus 730 can be used 
in common to each tag ID information idn, whereby the amount of 
10 calculations in the backend apparatus 730 can be drastically reduced, 
permitting an efficient retrieval. 

[0078] Specifically, denoting the number of the tag devices 710 by m and 

the number of hashing operations in the backend apparatus 730 (the number 

of times the confidential value is updated for the tag device 710) by j, the 
15 embodiment 1 required a number of hash operations which is equal to 2mj. 

By contrast, in the embodiment 7, the number of hash operations can be 

suppressed to mj+j. 

In addition, the tag device 710 delivers the number of times m the 

confidential value Si is updated together with the tag output information G(Si | 
20 Wk), and if the number of the times it is updated m is fed to the backend 

apparatus 730 (see the embodiment 4), the number of hash operations in the 

backend apparatus 730 can be reduced down to m+j. 

[0079] [Embodiment 8] 

An embodiment 8 is a modification of the embodiment 1 , and differs 
25 from the embodiment 1 in that a combination of a plurality of elements is 

allotted as a value which is inherent to each tag device. In this manner, part of 

elements which are allotted to each tag device can be shared by a plurality of 
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tag devices, with consequence that a total amount of calculations which are 
required to recognize a tag device can be reduced. 

Fig. 1 5 is an illustration of an overall arrangement of an automatic 
tag identification system 800 of the embodiment 8. In this Figure, parts which 
5 are common to the embodiment 1 are designated by like numerals as used in 
the embodiment 1 . Fig. 16 A shows an example of data which are stored in a 
confidential value memory 811 of a tag device 810, and Fig, 16 B shows 
examples of data which are stored in a database memory 83 1 of a backend 
apparatus 830. In addition Fig. 17 and Fig. 18 are flow charts for describing 
10 processings in the embodiment 8. 

[0080] A functional arrangement and a processing method of the 
embodiment 8 will be described below with reference to these Figures. It is to 
be noted that what is common to the embodiment 1 will be omitted from 
description. 
15 <pre-processing> 

By way of example, using a random number generator (not shown) 
or the like, a set of initial values of elements which are allotted to respective 
tag devices 

(bi,i,o,..., bij,o,..., b,.p,o)*"(b„ 1 0 b„j,o,..., \p,o)"<\io. \j.o,,.., t>d,p,o) 
20 are generated. A set of elements within each "( )" will be referred to as a 
sub-group (u e {1, • • • , d} ) . 

[0081] Here, j is a natural number (jG{l, p}) which satisfies l<j<p, 
and u is a natural number (u e {1, • • d}) which satisfies l<u<d. In the 
embodiment 8, a combination of a plurality of elements defines one 
25 confidential value, and d(d>2) represents a number of elements which 

constitute one confidential value, m is a number equal to or greater than a 
total number of tag devices 810 (a total number of required confidential 
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values) and which satisfies a requirement that m=p^ is a natural number. 

Combinations of elements thus generated are allotted to respective 
tag devices 810. Specifically, one element is selected fi-om each of d kinds of 
sub-groups ttu which constitutes together the set of initial values of above 
5 mentioned elements, and selected d combinations of initial elements fu, o 
(f, Q ... fy Q ... fj o) are allotted to respective tag devices 810 

(^1, 0 ^ {^1, 1,0' ^1, q,0' '^l, p, o}> ""5 ^u, 0 ^ {^u, 1,05 '"5 l^u, q, 0> '^u, p, o}> 

fd,o^(bd, 1,05 •••''^d.q,05 "sb^.p^o})- It is to be noted that this allotment 
is made so that a same combination does not occur for different tag devices 

10 810, and a total of m kinds (a total number of tag devices 8 1 0) of 

combinations (fi^ 0, fu, 0, . fd, 0) are allotted. Altematively, a plurality of 
combinations of initial elements fu,o may be related to a single tag device 810, 
and in this instance, a total of m kinds or more (a total number of tag devices 
8 10 or more) combinations of (fi, 0, . fu, 0, fd, 0) are allotted. At least part of 

1 5 elements which constitute each (fi, 0, fu, 0, fd, 0) is shared by a plurality of 
tag devices 810. 

[0082] All the combinations (fi, 0, fu, 0, fd, 0) which are generated 
(combinations of d(d>2) initial elements fu, o(u e {1, • d}) are related to tag 
ID information idn of each allotted tag device 810 and data datan 

20 corresponding to each tag device 810, and are stored in a database memory 
831 of the backend apparatus 830. It is to be noted that n assumes a value 
which corresponds to each tag device, and corresponds to a suffix k of tag 
output information a^, i (to be described later) which is delivered from each tag 
device. In other words, the number of combinations of d initial elements fu, 0 

25 which are stored in the database memory 83 1 is equal to the total number of 
tag devices 810. Where a plurality of combinations of initial elements fu,o are 
related to a single tag device 810, the number of combinations of d initial 
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elements fu, o which are stored in the database memory 83 1 will be equal to or 
greater than the total number of tag devices 810. 

[0083] Combinations of generated initial elements (fi, o, fu, o, fd, o) 
(equivalent to "combinations each comprising d(d > 2) elements eu, vu 
5 (u e {1, • d} ) and corresponding to respective tag ID information idk" 
where vu represents an integer equal to or greater than 0 and indicating the 
number of times the element Cu, vu is updated and the suffix vu of the element 
Cu, vu represents Vu) are stored in the confidential value memory 81 1 of 
respective allotted tag devices 810. In the description to follow, a combination 

10 of initial elements which is stored in the confidential value memory 8 1 1 of 
each tag device 810 is indicated by (ci, o, eu, o, ed, o)- 
[0084] In the example of Fig. 16, an allotment of initial elements for d=2, 
p=3, m=9 is shown. 

As shown in Fig. 16 B, for this example, combinations 83 laa of 

15 initial elements ((f^ ^ f^^ o) (f^ o ^ {\ o^\2,o^ \ 3, o)^ 

^2, 0 ^ {\ 1, 0' \ 2, 05 ^2 3^ o))' tag ID information 831ab (idn (n g {1, 9}) 
and data 83 lac (datan (n e {1, • • - , 9} ) are stored in the database memory 83 1 
of the backend apparatus 830 in a manner relating to each other. 
[0085] As shown in Fig. 16 A, one set of combinations of initial elements 

20 811a ((ei, o, e2, o)=(bi, 2, 0, hi, 2, 0 )) which corresponds to the tag ID information id 
is stored in the confidential value memory 81 1 of the tag device 810. It is to 
be noted that part of the element Cu, vu which is stored in the confidential value 
memory 8 1 1 is also stored in the confidential value memory of another tag 
device as a corresponding element in another tag device. 

25 <processing by tag device> 

A processing which takes place when the tag device 810 is read by 
the reader 20 during an i-th run (i is a natural number) will be described 
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below. 

[0086] Initially, in a hash calculator 812 (equivalent to "second calculator"), 
d elements vu extracted from the confidential value memory 811 (step 
SI 61), and a hash function G is applied to a combined value of these bit trains 
5 (confidential value Sk, i) to calculate the tag output information ak, i=G(Sk, i) 
(step SI 62) where k represents a value corresponding to each tag device and i 
is a natural number indicating a number of times delivered from the output 
section. It is to be noted that in the present embodiment, the confidential value 
Sk, i = ^1, vi I • • • I ^u, vu I • • * I ^d, vd the tag output information 

10 i = G(ei ^1 I • • • I ^ | • • • | e^,^^) are used, but the sequence in which 
bits of the respective elements eu, vu are disposed are not limited thereto. 
[0087] The generated tag output information ak, i is sent to an interface 114, 
which delivers the tag output information ak, i (step SI 63). 

Subsequently, a hash calculator 813 (equivalent to "first calculator") 

15 extracts elements Cu*, vu' (u'g {1, • • d} ), which are at least part thereof, from 
the confidential value memory 811, calculates a hash value H(eu>uO of the 
extracted elements eu\ vu* (step SI 64) and saves by overwriting the hash value 
H(eu', vuO as a new element Cu-, vu'+i in the confidential value memory 811 (step 
S 165). It is to be understood that a method of selecting u' e {1, • • d} may be 

20 any desired one. By way of example, a method of selecting a different u' each 
time the tag device 810 performs a communication, a method in which a 
separate u' is selected at the time every element e^^ vu* has been updated for 
one u', a method of selecting two or more u' concurrently can be cited. 
[0088] <processing by reader> 

25 The reader 120 receives a tag output information a^, i transmitted 

from the tag device 810 at its interface 122 (step SI 66), and sends it to the 
communication section 123. The communication section 123 extracts 
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products distribution information pd from products distribution information 
memory 121 (step SI 67) and transmits the products distribution information 
pd and the tag output information ak, i to the backend apparatus 830 through 
the network 140 (step SI 68). 
5 <processing by backend apparatus> 

The tag output information ak, i and the products distribution 
information pd which are transmitted from the reader 120 are received by the 
communication section 132, and are stored in the memory 136a (step SI 69). 
[0089] This triggers the controller 136 to substitute 1 for n and to store it in 

1 0 the memory 1 36a (step S 1 70), to select a combination of d Wu in the manner 
indicated below and to store the combination in the memory 136a (step SI 71). 
(Wi, wJeS^ = {Wj, w^ I w^ e[0, j^^^]} (where [a, p] represents a 
set of integers equal to or greater than a and equal to or less than p.) 

Then the controller 136 verifies, while referring to n and the 

15 combination of d Wu in the memory 136a and also referring to a hash value 
memory 838, whether or not a hash value H^(fu, o) which is a result of 
applying Wu times the hash fiinction H to d initial elements fu, o 
(u G {1, • • d} ) corresponding to the tag ID information idn is stored (is 

already generated) in the hash value memory 838 (step SI 72). It is to be noted 

20 that super-index wu in H^(fu, o) represents Wu- 

[0090] In the event it is determined that there remain some of hash values 
H'^"(fu, o) corresponding to the tag ID information idn which have not yet been 
calculated, a hash calculator 837 extracts initial elements fu, o corresponding to 
those of "the hash values H^(fu, o) corresponding to the tag ID information idn 

25 which have not yet been calculated" from the database memory 83 1 , applies 
Wu times the hash function H to these initial elements fu, o to calculate the hash 
value H'^(fu,o) (step SI 73). The calculated hash value H^(fu,o) is stored in 
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the hash value memory 838 (step SI 74), then retuming to the processing at 
step SI 72. 

[0091] On the other hand, if it is determined at step SI 72 that all of hash 
values H^(fu, o) corresponding to the tag ID information idn have been 
5 generated, the controller 136 causes, while referring to n and combinations of 
d Wu in the memory 136a, a hash calculator 833 (equivalent to "third 
calculator") to extract the hash values H^"(fu, o) which are obtained by 
applying w^^ times the first function Fl to d initial elements fu, o 
(u G {1, • • d} ) corresponding to the tag ID information idn from the hash 

10 value memory 838 (step SI 75) and to calculate a value c which is obtained by 
applying the hash value G to a bit combination value of these hash values 
H^(fu, o) (step 1 76). The calculated value c may be illustrated by 
c = G(H-^(f,o)| |H-"(fu,o)l I H"' (f,,o)), for example, but the bit 
disposition sequence of each hash value H'^(fu, o) is not limited thereto. 

1 5 However, the sequence should correspond to the bit disposition sequence of 
each element Cu, vu in the hash calculator 8 12 of the tag device 810. 
[0092] Then, the comparator 134 reads the tag output information ak, i from 
the memory 136a, receives the calculated value c from the hash calculator 833 
and compare them to determine if c=ak, i (step SI 77). In this example, the hash 

20 value c = G(H"'(f, o) I I H""(f„ o) I I H"^'(fd,o)) and the tag output 
information a^, i are compared against each other. 

In the event it is determined that these do not match, the controller 
136 determines whether or not all of d combination pattems 
(Wj, • • •, w^) e S^ have been selected while referring to the memory 136a 

25 (step SI 78). If it is determined that there exists a combination pattem which 
has not yet been selected, the controller 136 selects a new combination 
( Wj , • • • , w J ) e S^ , stores it in the memory 1 36a (step S 1 79) and causes the 



-49- 

processings at step SI 72 and subsequent steps to be executed for this new 
combination and n. 

[0093] On the other hand, if it is determined at step SI 78 that all of 
combination patterns have been selected, the controller 136 determines 
5 whether or not n=m while referring to n in the memory 136a (step S 1 80). If it 
is determined that n=m does not apply, the controller 136 updates n in the 
memory 13 6a by n+1 (step SI 81) and causes processings at step SI 72 and 
subsequent steps to be executed. On the other hand, if it is determined that 
n=m, an error termination of the processing results (step SI 82). 

10 It is to be noted that the processings which take place at steps S172 — 

181 are equivalent to re-executing the processings in the hash calculator 833 
and the comparator 134 by changing the value of at least part of n and Wu 
under the control of the controller 136 when the tag output information ak, i 
and the calculated value c do not match. 

1 5 [0094] On the other hand, if it is determined at step S 1 77 that the hash value 
c and the tag output information ak, i match, the read/write section 135 selects 
tag ID information idn which is related to the combination of a plurality of 
initial elements fu^ o corresponding to the hash value c from the database 
memory 83 1 imder the control of the controller 135, extracts the tag ID 

20 information idn and its corresponding data datan and sends them to the 

communication section 132. The read/write section 135 receives the products 
distribution information pd from the memory 136a, and writes this products 
distribution information pd as data datan corresponding to the tag ID 
information idn into the database memory 831 as an addition (step SI 83). 

25 [0095] The tag ID information idn and data datan which are sent to the 
communication section 132 are transmitted to the reader 120 through the 
network 140 (step SI 84), and are received by the communication section 123 
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of the reader 120 to be delivered (step SI 85). 
<features of embodiment 8> 
[efficiency] 

To calculate the hash value c in the hash calculators 838 of the 
5 backend apparatus 830, it is necessary to calculate a hash value H^(fu, o)=fii, vu 
In the embodiment 8, each element eu, vu can be used in common by a plurality 
of tag devices 810, and accordingly, if the hash value H^(fu, o)'=fu, vu which is 
calculated to calculate the hash value c corresponding to either one of the tag 
devices 810 is stored in the hash value memory 838, this element fu, vu can 

10 also be utilized in the calculation of hash values c corresponding to other tag 
devices 810. In this manner, the number of tag devices 810 which can be 
accommodated can be increased without increasing the number of hash values 
H'^Cfu, o) which must be calculated. Specifically, initial elements which are 
inherent to tag devices which are equal in number to can be allotted by 

1 5 using d* p elements. 

[0096] Because communication data is constructed by the calculation of 
hash functions alone, the scale of a circuit which is incorporated into the tag 
device 810 is small in comparison to a conventional method which generates 
random numbers, and this embodiment lends itself to an application which 

20 demands a low^ost. 

[impossibility of tracing] 

In the embodiment 8, tag output information ak, i= G(Sic i) is used in 
the communication. Because of the incapability to identify a hash value, this 
tag output information a^, i= G(sk, i) appears to be a mere random number to an 
25 attacker who does not know a confidential value. Accordingly, the attacker 

cannot know whether or not the tag output information a^, f= G(Sk, i) and ak, i+i= 
G(Sk, i+i) have been delivered from the same tag device 810, and therefore 
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cannot trace the distribution process of the tag device 810. 

[0097] [forward security] 

In the embodiment 8, an arrangement is used that the confidential 

value in the confidential value 811 which is used in the communication is 
5 updated by the hash function H. In addition, if the tag device 810 is tampered 

with to leak each element eu, vu^ the attacker cannot determine a past element 

^u, vu-Avu from the element Cu, vu due to the one-way nature of the hash function. 

Accordingly, if each element Cu, vu were leaked, the attacker cannot find a 

correspondence between each element Cu, vu acquired and the history of 
10 conrmiunications, and hence cannot trace the tag device 810. 

[0098] [traceability] 

On the other hand, on account of the difficulty of a collision between 

the hash functions G and H (the property that hash values of different values 

can hardly assume a same value), the backend apparatus 830 which knows 
15 each element Cu, vu is capable of tracing the distribution process of the tag 

device. 

In the embodiment 8, the set of initial elements which are generated 
by the backend apparatus 830 is chosen to be as follows: 

(bi,i,o,..., bi,j,o,..., b,,p,o)'--(b„,i.o,..., K},o...., bu.p.o)*--(bd,i,o,..., bdj,o,.... \p.o) 
20 Thus, p initial elements b are generated for each u (u e {1, • • •, d} ). However, 
the number of initial elements which are generated for each u (u e {1, • • d} ) 
may be different. 

[0099] The hash value H^(fu, o) (u e {1, • • - , d} ) which is required in the 
processing at step SI 76 may be determined by the hash calculator 837 of the 
25 backend apparatus 830 at the pre-processing step, and stored in the hash value 
memory 838. 

[Embodiment 9] 
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An embodiment 9 is a modification of the embodiment 8, and differs 
from the embodiment 8 in that a proper value which is inherent to each tag 
device is additionally stored in the confidential value memory of the tag 
device and the database memory of the backend apparatus, and a hash value 
5 aic, i= G(Sk, i) of a combination of bit trains including each element Cu, vu a 
proper value Yk is used as tag output information. This allows a situation that a 
confidential value of a particular tag device be determined on the basis of 
elements Cu, vu which are collected by tampering with other tag devices to 
trace the tag device to be prevented fi-om occurring. 

10 [01 00] Only a distinction over the embodiment 8 will be described below 
while omitting a description for what are common with the embodiment 8. 

Fig. 1 9 is an illustration of an overall arrangement of an automatic 
tag identification system 900 of the embodiment 9. Fig. 20 A illustrates 
examples of data which are stored in a confidential value memory 911 of a tag 

15 device 910, and Fig. 20 B shows examples of data which are stored in a 

database memory 93 1 of a backend apparatus 930. It is to be noted that in Fig. 
19, a functional arrangement which is common with the embodiment 1 is 
denoted by like characters as used in Fig. 2, and a functional arrangement 
which is common with the embodiment 8 is denoted by like characters as 

20 used in Fig. 1 5 without giving a description thereof. It is to be noted that 
while Fig. 19 shows only one tag device 910, there are a plurality of tag 
device 910 in actuality. 

[0101] A functional arrangement and a processing method of the 
embodiment 9 will be described below with reference to these Figures. 
25 <pre-processing> 

Differences over the embodiment 8 reside in that a proper value is 
additionally stored in the confidential value memory 91 1 of the tag device 910 
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and that a combination of d (d>2) initial elements fu, o (u e {1, • • - , d) ), a 
proper value Yk which is inherent to each tag device, and tag ID information 
idn of each tag device (n assuming a value which corresponds to each tag 
device) are stored in the database memory 93 1 of the backend apparatus 930 
5 in a manner relating these to each other. It is to be noted that proper values Yk 
and Yn are random values, for example. 

[0102] In the example shown in Fig. 20, an allotment of combined proper 
values for d=2, p=3, m=9 is shown. 

As shown in Fig. 20 B, in this example, a combination 93 laa of 

10 initial elements ((fi,o, f2,o) (fi,o^ {bi, i,o, bi,2,05 bi,3,o}, ^2,0^ {^i, 1,0, b2,2,o, ^2,3, 
0} )), the tag ID information 93 1 ab (idn ( n e {1, • • • , 9} ), data 93 1 ac (datan 
( n e {1, • • - , 9} ), and a proper value 93 lad which is inherent to each tag 
device (yr, k g {1, • • 12} ) are stored in the database memory 93 1 of the 
backend apparatus 930 in a manner relating these to each other. As shown in 

1 5 Fig. 20 A, a combination 91 1 a of initial elements ((ci, 0, ^2, o)=(bi, 2, Oj ^2, 2, 0)) 
and a proper value 91 lb (Yk ^5) are stored in the confidential value memory 
911 of the tag device 910. 
[0 1 03] <processing by tag device> 

A processing which occurs when the tag device 910 is read by the 

20 reader 120 during an i-th run (i being a natural number) will be described 
below. 

Initially, a hash calculator 912 (equivalent to "second calculator") 
extracts each element eu, vu and a proper value Yk from the confidential value 
memory 911, and calculates the tag output information a^, i= G(Sk, i) which is a 
25 hash value of a combination value (confidential value Sk, i) of bit trains 
including the extracted elements eu, vu and the proper value Yk- In the 
embodiment 9, a confidential value and tag output information are chosen to 
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be Sk^=Yk I ej^^i I ---le^^^ | and a^^^ = G(y J e,^^, | ---le^^^ 

I |ed,vd)- 

[0 1 04] Subsequently, the tag output information a,^ ■ is delivered and the 
elements in the confidential value memory 911 are updated in the similar as in 
5 the embodiment 8. 

<processing by reader> 

This remains to be similar to the embodiment 8. 
<processing by backend apparatus> 

A distinction over the embodiment 8 resides in that in place of the 
10 processing at step SI 76 in the embodiment 8 (Fig. 18), a hash calculator 933 
(equivalent to ''third calculator'') reads a proper value yn from the database 
memory 93 1 and calculates a hash value c of a combination value of bit trains 
including the hash value H^(fu, o) and the proper value Yn- In this example, a 
hash value c = G(yJ H-^(f,o) I - |H-"(fu,o) I I H-^(f,,o)) is 
15 calculated. In other respects, the processing is similar to the embodiment 8. 
[0 1 05] <features of embodiment 9> 
[impossibility of tracing] 

In the embodiment 9, the tag output information ak, i=G(Sk, i) which is 
a hash value of a combination of bit trains including elements eu, vu and the 

20 proper value Yk is delivered from the tag device 910. The proper value Yk is a 
value which is inherent to each tag device 910. Accordingly, if a certain tag 
device is tampered with, it is impossible to determine the past tag output 
information of a different tag device which shares the element Cu, vu^ from the 
hash value of data which are stored in the first mentioned tag device. 

25 Accordingly, an attacker cannot trace the different tag device. 
[0 1 06] [Embodiment 1 0] 

An embodiment 10 is a modification of the embodiment 8, and 
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difFers from the embodiment 8 in that t kinds (t>2) of manifold values z are 
stored in a manifold value memory of a tag device, and a hash value ak, i=G(Sk, 
i) of a bit combination value (confidential value Sk, i) of each element Cu, vu 
extracted from a confidential value memory and either one of the manifold 
5 values z is used as tag output information, with the confidential value memory 
being updated once for communication which counts t times. 

Only a distinction over the embodiment 8 will be described below 
while omitting a description for what is common with the embodiment 8. 
[0107] Fig. 21 is an illustration of an overall arrangement of an automatic 

10 tag identification system 1000 of the embodiment 10. Fig. 22 is a flow chart 
for describing processing in a tag device 1010, and Fig. 23 is a flow chart for 
describing processing in a backend apparatus 1030. It is to be noted that in 
Fig. 21, fimctional arrangements which are common to the embodiment 1 and 
the embodiment 8 are designated by like characters as used in Figs. 2 and 15. 

15 It is also to be noted that while Fig. 21 shows only one tag device 1010, there 
exist a plurality of tag devices 1010 in actuality. 

A fimctional arrangement and a processing method of the present 
embodiment will be described below with reference to these Figures. 
[0 1 08] <pro-processing> 

20 Differences over the embodiment 8 reside in that t kinds (t>2) of 

manifold values z are generated in a manifold value generator 1015 of the tag 
device 1010 and are stored in a manifold value memory 1016 (equivalent to 
"first manifold value memory") and that t kinds (t>2) of manifold values z 
which are shared by respective tag devices 1010 are stored in a database 

25 memory 103 1 (equivalent to "second manifold value memory") of the 
backend apparatus 1030. 

A manifold value generator 1015 can be illustrated by a counter 
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which counts z = 1 • • • t , a hash calculator which performs a calculation 
z=H(seed, x), x e (1, - • t} , a hash calculator which performs a calculation 
z=H^(seed), x e {1, • • t} or the like. Here, seed represents an initial value. 
In a description to follow, a manifold value z will be represented as z=7c(x) 
5 and count x g {1, • t} . Preferably manifold values z=7r(x) which 
correspond to respective values of x e {1, • • t} do not coincide. 
[0109] It is to be noted that the generation and storage of the manifold value 
z need not be performed during the pre-processing, but may be performed 
when processing a communication with the tag device 1010 or when 
10 processing a retrieval by the backend apparatus 1030. 
<processing by tag device> 

A processing which occurs when the tag device 1010 is read by the 
reader 120 during an i-th run (i being a natural number) will be describes 
below. It is to be noted that the initial value (i=l) of the count x is 1, and the 

15 count X is saved in a memory 1 15a under the control of a controller 115. 

[0110] Initially, a hash calculator 1012 (equivalent to "second calculator") 
extracts each element eu, vu from a confidential value memory 1011 and 
extracts either one of manifold values z (which is z=7i(x) in this example) 
from a manifold value memory 1016 (step S191). The hash calculator 1012 

20 calculates a hash function a^, i=G(Sk, i) of a bit combination value (confidential 
value Sk, i) of each extracted element Cu, vu and manifold value z as tag output 
information (step SI 92). In this example, a confidential value is chosen to be 
Sk, i = ^1, vi I " " I ^u, vu I " • I ^d, vd I z ' tag output information is chosen to 
be ak.=G(ei^, | ---le,^ | •••le^^^ | z) . It is to be noted the bit 

25 disposition sequence of each element eu, vu and the manifold value z and the 
number of manifold values z for bit combinations are not limited to this. 
Since it is presumed that manifold values z=7i(x) corresponding to 
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X G {1, • • s t} do not coincide, it follows that as long as elements in the 
confidential value 1011 are not updated, the manifold value z which is used 
by the hash calculator 1012 in generating tag output information ak, i varies 
from communication to communication. 
5 [0111] The generated tag output information a^, i is sent to an interface 114, 
which delivers the tag output information ak, i (step SI 93). 

Subsequently, a controller 115 performs an arithmetic operation 
x^x+1 (count up) (step SI 94), and determines whether or not x>t (step SI 95). 
If it is determined that x>t does not apply, the processing in the tag device 

10 1010 is terminated while maintaining the value x in the memory 1 1 5a. 

On the other hand, if it is determined that x>t, the controller 1 1 5 
changes the count x in the memory 1 15a to x^l (step SI 96), and a hash 
calculator 1013 extracts at least part of elements w (u' e {1, • • d} ) firom 
the confidential value memory 1011 and calculates a hash value H(eu', vuO of 

15 extracted element vu- (step SI 97). The hash calculator 1013 overwrites this 
hash value H(eu', vu ) into the confidential value memory 1011 as a new 
element eu-, vu+i (step S 198). Any technique of selecting u' e {1, • • •, d} may 
be used. 

[0112] <processing by reader> 
20 This remains to be similar to the embodiment 8. 

<processing by backend apparatus> 

The tag output information ak, i and products distribution information 
pd which are transmitted firom the reader 120 are received by a 
communication section 132 and stored in a memory 136a (step S201). 
25 This triggers the controller 136 to substitute 1 for n to be stored in 

the memory 136a (step S202), to select a combination d Wu's in the manner 
indicated below, and to store the combination in the memory 136a (step 
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S203). 

[0113] (Wp ...,wJeS^={Wi, wj e[0, 

The controller 136 then refers to n and the combination of d Wu's in 
the memory 136a and also refers to the hash value memory 838 to verify 
5 whether or not hash values H'^(fu, o) which are results of applying Wu times 
the hash function H to d initial elements fu, o (u e {1, • • d} ) corresponding to 

tag ID information idn are stored in the hash value memory 838 (whether or 
not they have been generated) (step S204). It is to be noted that the 
super-index wu in H^"(fu, o) represents Wu- 

10 [0114] If it is determined that there exist some of the hash values H^(fu, o) 
corresponding to the tag ID information idn which have not yet been 
calculated, a hash calculator 837 extracts initial elements fu, o corresponding to 
"some of the hash values H^(fu, o) corresponding to tag ID information idn 
which have not yet been calculated" from the database memory 1031, and 

1 5 calculates the values H'^(fu, o) by applying Wu times the hash function H to 

these initial elements fu, o (step S205). The calculated hash values H^(fu, o) are 
stored in the hash value memory 838 (step S206), then returning to the 
processing at the step S204. 

[0115] On the other hand, if it is determined at the step S204 that all of hash 
20 values H^(fu, o) corresponding the tag ID information idn have been generated, 
the controller 136 causes, while referring to n and the combination of d Wu's 
in the memory 136a, a hash calculator 1033 (equivalent to "third calculator") 
to extract a hash value H^(fu, o) which is a result of applying w^ times the first 
function Fl to each of d initial elements fu o (u e {1, • d} ) corresponding to 
25 the tag ID information idn (step S207). The controller 136 sets up a count x* of 
1 and stores it in the memory 136a (step S208) and extracts a manifold value 
z=7c(x') from the database memory 1031 to be fed to the hash calculator 1033. 
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The hash calculator 1033 then calculates a calculated value c by applying the 
hash value G to a bit combination value of the hash value H'^(fu, o) and the 
manifold value z (step S209). The calculated value c can be illustrated as 
c = G(H-^(f,o) I |H-"(f,o) I |H-'(fd,o)|z).forexample,butthebit 
5 disposition sequence of each hash values H'^(fu, o) and the manifold value z 
and the number of the manifold value z which are used in the bit combination 
are not limited to this. However, there is a requirement that the sequence 
thereof or the like should be related to the bit disposition sequence of 
elements in the hash calculator 1012 of the tag device 1010. 

10 [0116] The comparator 134 then reads tag output information a^, i from the 
memory 136a, receives the calculated value c from the hash calculator 1033, 
and compare them to determine whether or not c=ak, i (step S210). In this 
example, the hash value c = G(H"^(fi o) I I H""(f„ o) I |H"'(f,o)|z) 
and the tag output information ak, i are compared against each other. 

15 In the event it is determined that these do not match, the controller 

136 determines whether or not x' in the memory 136a is t (step S21 1). If it is 
determined that x'=t does not apply, the controller 136 updates x' in the 
memory 136a by x'+l and then causes the processings at step S209 and 
subsequent steps to be executed (step S212). On the other hand, if it is 

20 determined that x'=t, the controller 136 determines, by referring to the 
memory 136a, whether or not all of d combination pattems 
( Wj , • ■ • , w J ) e are already selected (step S2 1 3). 

[0117] If it is determined that there exist some combination pattems which 
are not yet selected, the controller 136 selects a new combination 
25 ( Wj , • • • , w^ ) e , stores it in the memory 1 36a (step S2 1 4) and causes the 
processings at and subsequent to step S204 to be executed for this new 
combination and n. On the other hand, if it is determined at step S213 that all 
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of combination patterns have been selected, the controller 136 determines 
whether or not n=m by referring to n in the memory 136a (step S215). If it is 
determined that n=m does not apply, the controller 136 updates n in the 
memory 136a by n+1 (step S216), and causes the processings at and 
5 subsequent to step S204 to be executed. However, if it is determined that n=m, 
an error termination of the processing results (step S217). 
[0118] It is to be noted that the processings which take place at steps S204 - 
216 are equivalent to re-executing the processings in the hash calculator 1033 
and the comparator 134 by changing the value of at least part of n, Wu, and z 

10 under the control of the controller 136 when the tag output information ajc, i 
and the calculated value c do not match. 

On the other hand, if it is determined at step S210 that the hash value 
c matches the tag output information ak, i, the read/write section 135 selects 
tag ID information idn which is related to the combination of a plurality of 

1 5 initial elements fu, o corresponding to the hash value c from the database 

memory 1031, extracts this tag ID information idn and its corresponding data 
datan and sends them to the communication section 132 under the control of 
the controller 135. In addition, the read/write section 135 receives products 
distribution information pd from the memory 136a, and writes this products 

20 distribution information pd as data data„ which corresponds to the tag ID 
information idn into the database memory 1031 as an addition (step S218). 
The tag ID information idn and data datan which are sent to the 
communication section 132 are transmitted to the reader 120 through the 
network 140 (step S219). 

25 [0119] <features of embodiment 1 0> 
<impossibility of tracing> 

In the tag device 1010 in the present embodiment, a hash value of a 
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bit combination value of elements eu, vu and the manifold values z is used as 
tag output infomiation ak, i. Accordingly, the output value can be changed by 
changing the manifold value z without updating the elements e^, vu- On 
account of one-way nature of the hash function, a correlation with the output 
5 value which is changed in this manner cannot be obtained. In addition, 

because the manifold value z assumes t kinds of values, it is possible for the 
tag device to perform t times at maximum of communication which it is 
difficult to trace without updating elements Cu, vu- 
[0120] [efficiency] 

10 In the tag device 1010 of the present embodiment, elements Cu, vu in 

the confidential value memory 1 1 are updated only once for t times of 
communications. Accordingly, the amount of the calculations required for 
updating processing in the tag device 1010 can be reduced by a factor of 1/t. 
Also, a cohiparison between the hash value c and the tag output 

15 information ak, i which takes place in the backend apparatus 1030 can take 
place T times at maximum without changing a combination of hash values 
H^"(fu, o)- Accordingly, if a permissible number of communications of the tag 
device 210 (a maximum value of accesses from the reader 120 to the tag 
device 1010) were increased, the hash processing in the backend apparatus 

20 1030 does not increase significantly. 
[0121] [Embodiment 11] 

An embodiment 1 1 is a modification of the embodiment 10, and 
differs from the embodiment 10 in that a manifold value Zu which assumes tu 
kinds (t^ > 2 ) of values is stored for each u (u e {1, • • d} ) in a manifold 

25 value memory of a tag device, and a tag output information 

. =G(e,yi I z, I le^^d | z^) for a bit combination value of each 

element eu^ vu extracted from a confidential value memory and either one of 
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manifold values Zu is used as an output value. In addition, while each element 
eu, vu in the confidential value memory which corresponds to each u 
(u € {1, - - , d} ) is performed once for commutations of t times, in the 
embodiment 11, the point in time of communication when element Cu, vu is 
5 updated is shifted, so that either one of elements eu-, vu* (u' e {1, • • • , d} ) in the 
confidential value memory is updated each time the tag device delivers the tag 
output information a^, i. This prevents the tag device firom being traced if the 
tag device is tampered with at any point in time of communication. 
[0122] Only a distinction over the embodiment 1 and the embodiment 10 

10 will be described below while omitting a description for what is common with 
the embodiment 1 and the embodiment 10; 

Fig. 24 is an illustration of an overall arrangement of an automatic 
tag identification system 1100 of an embodiment 11. Fig. 25 is a flow chart 
for describing processing by a tag device 1110, and Fig. 26 is a flow chart for 

15 describing part of processing by a backend apparatus 1 130, It is to be noted 
that in Fig. 24, fiinctional arrangements which are common to the 
embodiment 1 and 8 are designated by like characters as used in Figs. 2 and 
15. In addition, while only one tag device 1 1 10 is shown in Fig. 24, in 
actuality, there are a plurality of tag devices 1110. 

20 [0 123] A fimctional arrangement and a processing method of the present 
embodiment will be described below with reference to these Figures. 
<pre-processing> 

Differences with respect to the embodiment 10 reside in that a 
manifold value generator 1 1 15 of a tag device 1110 sets up a manifold value 
25 Zu which assumes tu kinds ( t > 2 ) of values for each u ( u g (1, • • • , d} ) and it is 
stored in a manifold value memory 1116 (equivalent to "first manifold value 
memory") and that a manifold value Zu which assumes tu kinds ( t > 2 ) of 
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values for each u (u e {1, • • d} ) is stored in the database memory 1131 
(equivalent to "second manifold value memory") of a backend apparatus 1 130. 
It is to be noted that manifold values Zu which are stored in the database 
memory 1131 are same as manifold values Zu which are stored in respective 
5 tag devices 1110. 

[0124] The manifold value generator 1115 can be illustrated by a counter 
which counts z^ = 1 • • • t^ for each u ( u e {1, • • • , d} ), a hash calculator which 
performs a calculation of Zu=H(seed, Xu), g {1, • • t„ } or a hash calculator 
which performs a calculation of Zu=H'^(seed), x„ g {1, • t„ } . In the 

10 description to follow, manifold value Zu is expressed as Zu=7Cu(Xu), 

x„ e {1, ' • t^} . Preferably, tIu is set up such that for an equal value of u, 
manifold values Zu=Uu(Xu) corresponding to x„ g (1, • • t„} do not coincide. 
[0125] In the embodiment 1 1 , each Xu is expressed as Xu=i+8u 
(u G {1, • d} ) where i represents the number of times a communication is 

1 5 made by the tag device 1110, and represents a constant representing an 

offset from i of each x„ (an integer which satisfies 0 < 8^ < r^^^^ ), and where 
Tmax represents a maximum number of times an access is made from the reader 
120 to the tag device 1110. 

In addition, in the embodiment 1 1 , 8u and tu are set up such that at 

20 any point in time when a communication is made, Xu=tu is always satisfied by 
either one of Xu. For example, tu corresponding to each u (u g {1, • • d} ) 
always assumes an equal value while each Su is set up such that a set of 8u 
(u G {1, • • d} ) becomes a universal set of natural numbers less than tu. 
[0126] It is not necessary that the generation and the storage of manifold 

25 values Zu be performed during the pre-processing, but may be performed at 
the time a communication with the tag device 1 1 10 is processed or at the time 
a retrieval by the backend apparatus 1 130 is processed. 
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<processing by tag device> 

A processing which takes place when the tag device 1 1 1 0 is read by 
the reader 120 during an i-th run (i being a natural number) will be described 
below. It is to be noted that the count Xu (u g {1, • • d} ) has an initial value 
5 (at i=l) which is equal to l+8u, and each count Xu is saved in a memory 1 15a 
under the control of the controller 115. 

[0127] Initially, a hash calculator 1112 (equivalent to "second calculator") 
extracts each element Cu, vu from a confidential value memory 1111 and 
extracts either manifold value Zu (which is Zu=7Cu(xu) in this example) from a 
1 0 manifold value memory 1116 (step S23 1 ). The hash calculator 1112 calculates 
tag output information aj^ i=G(ej^j | Zj | | e^j | z^,) which is a hash 

value of a bit combination value (confidential value Sk, i) of each extracted 
element Cu, vu and either manifold value Zu (step S232). Where is set up such 
that manifold values Zu=7iu(Xu) corresponding to x^ e {1, • • t^} do not 
15 coincide for an equal value of u, it follows that as long as elements in the 

confidential value memory 1111 are not updated, the manifold value Zu which 
is used by the hash calculator 1 1 12 in generating tag output information a^, i 
varies from communication to communication. In addition, a bit combination 
sequence in the confidential value s,^ ^ = e, | z, | • • • | e^, | z^ is not 

20 limited thereto. The generated tag output information a^, i is sent to the 
interface 114, which transmit this tag output information ak, i (step S233). 
[0128] Subsequently, in the controller 136, an arithmetic operation of 
Xu^Xu+1 ( u e {1, • • d} ) takes place for Xu in the memory 136a (step S234). 
It is to be noted that in the embodiment 1 1 , £u and tu are set up such that Xu=tu 

25 applies for either Xu at any point in time of any communication. Accordingly, 
as a result of the arithmetic operation Xu^Xu+1, Xu>tu applies for either Xu. 
The controller 136 then substitutes 1 for Xu which satisfies Xu>tu (step S235). 
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In the present embodiment, u which corresponds to this Xu is represented by 
u'. 

Subsequently, the hash calculator 813 extracts a partial element Cu', vu* 
(an element corresponding to above mentioned u' e {1, • • d) ) from the 
5 confidential value memory 1111, and calculates a hash value H(eu', vu ) of the 
extracted element vu' (step S236). The hash calculator 813 overwrites the 
hash value H(eu», vu) as a new element Cu-, vu'+i into the confidential value 
memory 1111 (step S237), then completing a processing by the tag device 
1110. 

10 [0129] By the processing mentioned above, it follows that each time the 
interface 114 delivers tag output information a^ ^ , the hash calculator 813 
extracts at least one of elements Cu*, vu* (u* g {1, • • d} ) from the confidential 
value memory 1111, calculates the hash value H(eu', vuO of the extracted 
element Cu , vus thus updating the confidential value memory 1111. 
1 5 <processing by reader> 

This remains to be similar to the first mode. 
<processing by backend apparatus> 

A distinction of the embodiment 1 1 over the embodiment 10 resides 
in that the processing indicated at step S26 is performed in place of 
20 processings at steps S208 - S213 shown in Fig. 23. 

[0130] Specifically, subsequent to the processing at the step S207, the 
controller 136 selects a combination of (Xj, • • - , x^) e as indicated below, 

and stores it in the memory 136a (step S241). 
(x„ xJeS, ={x,, X, |x, €[0, tj} 
25 The controller 136 refers to the combination of (x,, • • x^) e in 

the memory 136a, extracts d manifold values Zu=7c(Xu) (u e {1, - - d} ) which 
correspond to this from the database memory 1131, and send them to a hash 
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calculator 1 133, which then calculates a calculated value c which is a result of 
applying the hash value G to a bit combination value of the hash value H'^^Cfu, 
o) and the manifold value Zu (step S242). The calculated value c can be 

illustrated by c = G(H-'(f,o) I I - I H-"(f,,o) I I - I H^^f.^o) I 
5 Zj) , for example, but the bit disposition sequence of each hash value H^(fu, 

o) and the manifold value Zu is not limited thereto. However, the sequence or 

the like is required to correspond to the bit disposition sequence of each 

element in the hash calculator 1 1 12 of the tag device 1110. 

[0131] The comparator 134 then reads tag output information ak, i from the 

10 memory 136a, receives the calculated value c from the hash calculator 1 133, 
and compares them against each other to determine whether or not c=ak, i (step 
S243). In this example, the hash value c = G(H"^(f, o) I Zi I 

••• I H""(f„ o)|z„ I I H"'(f, o)|Zd) and the tag output information ak,i 
are compare against each other. 

15 In the event it is determined that these do not match, the controller 

136 refers to the memory 136a to determine whether or not all of combination 
pattems (x,, • • •, x^) e have been selected (step S244). If it is determined 
that all of combination pattems (x, , • • , x^j ) e have not been selected, the 
controller 136 selects a new combination (Xj, • • x^j) g S^^ , and stores it in 

20 the memory 136a, whereupon it causes the processings at and subsequent to 
step S242 to be executed. On the other hand, if it is determined at step S244 
that all of the combination pattems (x, , • • • , x^^ ) e S^, have been selected, the 
operation proceeds to step S213 in Fig. 23. On the other hand, if the 
processing at step S243 reveals a determination that c=aic, i, the operation 

25 proceeds to step S218 in Fig. 23. 
[0132] [efficiency] 

The comparison between the hash value c and the tag output 
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information ak, i in the backend apparatus 1 130 takes place tiH-t2+. . .+td.i+td 
times at maximum without changing the combination of hash values H'^(fu,o)- 
Accordingly, if a permissible number of communications of the tag device 
1 1 10 (a maximum value of accesses from the reader 120 to the tag device 
5 1110) increases, the amount of the processing in the backend apparatus 130 
does not increase significantly. 

[impossibility of tracing] 

In the tag device 1 1 10 of the embodiment 11, each time the tag 
output information ak^ i is delivered, either element Cu', vu* (u' e {1, - • • , d} ) 

10 which is stored in the confidential value memory 1111 is updated by a hash 
chain. Accordingly, if the tag device 1 1 10 is tampered with and an element Cu*, 
vu' within the confidential value memory 1111 is leaked to an attacker, the 
attacker cannot find a correlation between the element Cu-, vu-t before the 
updating and an element eu, vu- after updating due to one-way nature of the 

15 hash function. Hence, the attacker cannot obtain a correlation between an 
element acquired from the confidential value memory 1111 and an output 
value which is delivered from the tag device in the past. In this manner, a 
tracing of the tag device 1110 can be prevented. 

[0133] In addition, in the embodiment 1 1, if the tag device 1 1 10 is tampered 
20 with to leak each manifold value Zu, any element Cu-, vu* which is stored in the 

confidential value memory 1111 is updated by overwriting. In this manner, an 

influence of the tag device 1110 being tampered with can be minimized. 

It is to be noted that in the embodiment 1 1 , Su and tu are set up so that 

it is assured that Xu=tu is satisfied by either Xu at any point in time of 
25 communication. By way of example, a choice is made such that 

t, = t2 = • • • = t^ , and a counter Xu corresponding to each element Cu, vu is 

displaced by 1 (Xu=i+u/d). 
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[0134] However, rather than choosing an equal value for t^ (u e {1, • d} ), 
each counter Xu corresponding to each element eu, vu niay be displaced by a 
spacing which is determined by dividing tu having a largest value into d 
sections. In this instance, the requirement of perfectly forward secure may not 
5 be satisfied, but it is at least possible to suppress the influence of tampering. 
[Embodiment 12] 

An embodiment 12 is a modification of the embodiment 11. In a 
similar manner as in the embodiment 1 1, in the embodiment 12 also, a point 
in time of communication when each element Cu, vu is updated is shifted. 
10 However, in the embodiment 12, each time a tag device delivers the tag 

d 

output information a^, i times, either element e^', vu* is extracted, and a 

u=l 

hash value H(eu', vuO of the extracted element eu*, vu' is calculated. 

[0135] Specifically, in response to each extemal access, the tag device of 

the embodiment 12 counts up a counter x^ e (1, t^^} corresponding to 

15 either one of d elements Cu, vu (for example, counts up by 1 in the sequence of 
e, ^1 • • - e^ ). Because the counter Xu corresponds to the manifold value Zu 
which constitutes the tag output information a^ • = G(e^ | Zj | 
* * * I ^d, vd I , this tag device is capable of delivering the tag output 

d 

information ak, i having different values ^ t^ times without updating each 

u=l 

20 element eu, vu- In the present embodiment, either element Cu, vu is updated each 

d 

time the tag output information a^, i is delivered ^t„ times. In this manner, 

u=l 

the amount of calculations for updating the tag device is minimized while 

maintaining the manifoldness of output values of the tag device. 

[0136] In the following , only a distinction over the embodiments land 1 1 
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will be described while omitting a description for what is common with the 
embodiments 1 and 1 1 . 

Fig. 27 is a flow chart for describing processing by the tag device of 
the embodiment 12. It should be noted that the entire functional arrangement 
5 is similar to embodiment 1 1 (Fig. 24). 

A processing method of the present embodiment will be described 
below with reference to these Figures. 

<pre-processing> 

In the embodiment 1 1, a choice is made that Xu=i+Eu ^ (Ij " s d} ) 

10 and 8u and tu are set up such that it is assured that Xu=tu is satisfied by either Xu 
at any point in time of communication. In the embodiment 1 2, these 
limitations are not employed. 
[0137] <processing by tag device> 

A processing which occurs when a tag device 3 10 is read by a reader 

15 20 during an i-th run (i being a natural number) will be described below. It is 
to be noted that the count Xu (u e {1, • • d} ) has an initial value (at i=l) equal 
to 1, and u' and u' also have initial values of 1. It is to be noted that u' 
corresponds to an element Cu-, vu' being updated while u" corresponds to the 
count Xu • of an element Cu", vu • which is being counted up. Each parameter is 

20 stored in a memory 136a under the control of the controller 136. 

[0138] Initially, the hash calculator 1112 extracts each element eu, vu from 
the confidential value memory 1111, and extracts either manifold value Zu 
(which is Zu=7Cu(Xu) in this example) from the manifold value memory 1116 
(step S241). The hash calculator 1112 then calculates tag output information 

25 J = G(e, | Zj | • • • | e^j^^ | z^) which is a hash value of a bit combination 

value of each extracted element eu, vu and either manifold value Zu (step S242). 
The generated tag output information a^, i is sent to the interface 114, 
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which transmits the tag output information a^, i (step S243). 

[0139] Subsequently, an arithmetic operation of + 1(U"G{1, d}) 

is applied to Xu" in the memory by the controller 136 (step S244), thus 
determining whether or not Xu">tu" (where tu- represents a maximum value of 
5 Xu") (step S245). If it is determined that Xu">tu" does not apply, processings by 
the tag device 1 1 10 are terminated. 

On the other hand, if it is determined that Xu' >tu the controller 136 
substitutes u"+l for u" in the memory 136a (step S246), and determines 
whether or not u">d (step S247). If u">d does not apply, the processings by 

10 the tag device 1110 are terminated, but if u">d applies, the hash calculator 
813 extracts an element Cu', vu' (an element corresponding to u*e {1, • • d} 
mentioned above) from the confidential value memory 1111, and calculates a 
hash value H(eu», vuO of the extracted element , vu* (step S248). The hash 
calculator 813 then saves this hash value H(eu', vu ) as a new element vu+i in 

15 the confidential value memory 1111 by overwriting (step S249). 

[0140] Subsequently, an arithmetic operation of v u' <— vu'+l (a number of 
updates) takes place in the hash calculator 813, for example, (step S250) and 
it is determined whether or not vu' has exceed a maximum value (max) of 
the number of updates for the element Cu-, vu' (step S251), If it is determined 

20 that vu'>max does not apply, processings by the tag device 1110 are 

terminated, but if vu*>max, arithmetic operations of u*<— u*+l (a change of the 
element being updated) and vu*<— 0 (resetting of the number of updates for the 
element being updated) take place in the controller 136 (step S252), and these 
results are stored in the memory 136a before terminating the processing by 

25 the tag device 1110. 

[0141] By the processings mentioned above, it is seen that each time the 
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interface 114 delivers tag output information a^, i ^t„ times, the hash 

u=l 

calculator 813 extracts either element vu* from the confidential value 
memory 1111 and calculates a hash value H(eu', vu ) of the extracted element eu-, 
vu' to update the confidential value memory 1 1 . 
5 <processing by reader> i 

This remains to be similar to the embodiment 8. 
<processing by backend apparatus> 
This remains to be similar to the embodiment 1 1 . 
[0 1 42] <features of embodiment 1 2> 
10 [efficiency] 

In the embodiment 12, either element eu-, vu* is updated each time the 

d 

tag device 1110 performs a communication ^ t^ times, and accordingly an 

u=l 

amount of calculations for updating processing in the tag device 1110 can be 
reduced. In other words, in the present embodiment, tag output information 
15 ak,i=G(e, y, I z, | le^ ^^ | z^) is generated and delivered while 



d 



substituting manifold values which are equal in number to ^t^ for every 

u=l 

communication. Accordingly, during the communications which are equal in 

d 

number to ^t„ , the manifoldness of the output value of the tag device can 

u=l 

be secured without updating the element eu, vu- By updating either element e^^ 

d 

20 vu' for every ^t^ communications, the manifoldness of the output during 



d 



the following ^t^ communications can be secured. Since the element eu-, . 



u=l 



-72- 



is updated only once for communications, the amount of calculations 

u=l 

for updating in the tag device 1110 can be minimized. 
[0 1 43] [impossibility of tracing] 

The tag device 1 1 10 of the present embodiment is constructed such 

d 

5 that each time the interface 114 delivers tag output information a^, j y^ t„ 

u=l 

times, the hash calculator 813 updates the confidential value memory 1111. 
Accordingly, if the tag device 1 1 10 is tampered with to leak elements Cu-, vu' in 
the confidential value memory 1111 to an attacker, the number of past output 
values from the tag device 1110 which the attacker can know is less than 

d 

10 ^ . This allows the tracing of the tag device 1 10 to be suppressed while 

u=l 

reducing the amount of processing for update calculations of the tag device 
1110. 

[0144] [Embodiment 13] 

An embodiment 13 is a modification of the embodiments 1 to 4, and 
15 6 to 12, and is characterized in two kinds of hash functions G(x) and H(x) 
used. In the description to follow, only these hash functions H(x) and G(x) 
will be described. 

<No. 1> 

The hash function G(x) in this example is hash(l | x) where hash 
20 represents a hash function for {0, 1 }*— ^{0, 1 Y where r represents a natural 
number, and the hash function H(x) is hash(0 | x). It should be noted that a | p 
represents a bit combination of a and p. The hash function G(x) may be 
chosen to be hash(0 | x) while the hash function H(x) may be chosen to be 
hash(l I x). 
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[0145] <No. 2> 

The hash function H(x) (first function Fl) in this example is hash(p | 
x) where r, s are natural numbers, hash represents a hash function for {0, 
1 }*^{0, l}\ and p G {0, 1}^ . The hash function G(x) (second function F2) is 
5 hash(q | x) where q e (0, 1}^ and p9^q. 

<No. 3> 

The hash function H(x) (first function Fl) is hash(pad(x, p)) when p 
padded to x (a padding of p to x) is represented by pad(x, p) where p e {0, 1}^ . 
The function G(x) (second function F2) is hash(pad(x, q)) when q padded to x 
10 (a padding of q to x) is represented as pad(x, q) where q e {0, 1}^ and p^q. A 
padding position (a position in a bit train) of p or q relative to x is not 
restricted in particular. By way of example, p or q may be bit combined before 
or after x or may be inserted into a bit train of x. 
[0146] <No. 4> 

15 The hash function H(x) (first function Fl) is hash(x) where hash 

represents a hash function for {0, 1 }*-^{0, 1 }^ and the function G(x) (second 
function F2) is hash(rx) where rx represents a bit inversion of x, 
<effect of embodiment 13> 

In the present embodiment, while using only one kind of hash 
20 function, two kinds of hash calculations G(x), H(x) can be implemented 

without collapsing the properties thereof (one-way nature, delivering random 
values). This allows a circuit scale which constitutes a hash function to be 
reduced, with a consequence that the scale of a circuit which is assembled into 
a tag device can be made smaller, realizing a reduction in the cost of a tag 
25 device. 

[0147] [Second Mode] 
<arrangement> 
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A second mode for carrying out the present invention will now be 
described. 

In this mode, an updater which is provided extemally of a tag device 
updates a privileged ED information which is stored in a tag device to a new 
5 privileged ID information, the association of which with respect to the 
privileged ID information is difficult to follow at a given opportunity. 

<arrangement> 

Fig. 28 is a block diagram illustrating a schematic arrangement of the 
present mode. 

10 [0148] An illustrated in Fig. 28, an updating system 1500 of the present 
mode comprises a tag device 1510 and a security server 1560 which is 
provided extemally thereof. 

A tag device 1510 comprises a confidential value memory which 
stores privileged ID information which has privileged a tag ID information 

15 which is inherent to each tag device, a read/write section 1512 electrically 

connected with the confidential value memory, a first output section 1513 and 
a second input section 1514 electrically connected with the read/write section 
1512. 

A security server 1560 comprises a first input section 1561, an 
20 updater 1562 electrically connected with the first input section 1561, and a 
second output section connected to the updater 1562. 
[0 149] <update processing of privileged ID> 

An updating of a privileged ID takes place as described below. 
Initially, at a given opportunity, the read/write section 15 12 of the tag 
25 device 1510 reads out privileged ID information sidh which is stored in the 

confidential value memory 1511, and the first output section 1513 delivers the 
privileged ID information sidh to the security server 1560 which is provided 
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extemally of respective tag devices. 

The first input section 1561 of the security server 1560 accepts an 
input of privileged ID information sidh. And the updater 1562 generates new 
privileged ID information sidh', the association of which with the privileged 
5 ID information sidh is difficult to follow, and the second output section 1563 
delivers the new privileged ID information sidh' to the tag device 1510. 
[0150] The second input section 1514 of the tag device 1510 accepts an 
input of the new privileged ID information sidh', and the read/write section 
1512 stores the new privileged ID information sidh' in the confidential value 
10 memory 1511. 

[Embodiment 14] 

Fig. 29 is a conceptual view illustrating an overall arrangement of an 
updating system 2000 of an embodiment 14. 

As illustrated in this Figure, the updating system 2000 comprises a 

15 tag device 2010 such as a radio tag which is applied to goods, a client 
apparatus 2020, a backend apparatus 2050 which controls products 
distribution information or the like which relates to ID in plain text, and a 
security server 2060 which performs a restoration of ID, re-privileging of 
privileged ID (a server which re-privileges the privileged ID which is 

20 transmitted through the network and is equivalent to "updater"). The client 
apparatus 2020, the backend apparatus 2050 and the security server 2060 are 
connected to be capable of communication with each other through a network 
2070 such as internet or the like. It is to be noted that the client apparatus 
2020 has the function to operate as a reader described above in connection 

25 with the first mode. The effect which is implemented with the tag device, the 
reader and the backend apparatus in the first mode is implemented by the tag 
device 2010, the client apparatus 2020, the backend apparatus 2050 and the 
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security server 2060. While one tag device 2010, client apparatus 2020, 
backend apparatus 2050 and security server 2060 are illustrated in this Figure, 
it should be understood that normally there are a plurality of tag devices, and 
a plurality of client apparatus, backend apparatus and security servers may 
5 also be provided. 

[0151] The client apparatus 2020 of this example initially reads the 
privileged ID from the tag device 2010, and sends it to the security server 
2060. The security server 2060 restores ID from the privileged ID, and retums 
this ID to the client apparatus 2020. Upon receiving the ID, the client 

10 apparatus 2020 accesses the backend apparatus 2050 to demand an entry of 
information such as ID, a date and time of reading, a location of reading, a 
temperature or the like and an acquisition of information relating to ID or the 
like. A manner of utilizing a proxy model can be contemplated that the client 
apparatus 2020 transmits the privileged ID to the security server 2060, which 

15 then directly accesses the backend apparatus 2050. What is characterizing the 
present embodiment is that an apparatus such as the security server 2060 or 
the like which is provided extemally of the tag device 2010 re-privileges the 
privileged ID within the tag device 2010 (namely, updates the privileged ID to 
a separate privileged ID). 

20 [0152] Fig. 30 is a block diagram illustrating a fimctional arrangement of an 
updating system 1 of the present embodiment. 
<tag device> 

A tag device 2010 in this example comprises a confidential value 
memory 201 1, a read/write section 2012 (equivalent to "first read/write 
25 section"), an interface 2013 (equivalent to "first output section" and "second 
input section"), a memory 2014a and a controller 2014. 

Here, each of the confidential value memory 201 1 and the memory 
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2014a is an RAM (Random Access Memory) capable of read/write operation 
such as EEPROM (Electronically Erasable and Programmable Read Only 
Memory), FeRAM (Ferroelectric Random Access Memory), a flash memory, 
NV (Nonvolatile) RAM or the like, for example. The read/write section 2012 
5 is a hardware which reads/writes data from or into the confidential value 

memory 201 1 at a given address under the control of the controller 2014. The 
controller is an integrated circuit constructed to control processing by the 
entire tag device 2010, for example. 

[0153] The interface 2013 is a hardware which inputs or outputs data with 
10 respect to the client apparatus 2020 by the radio or wire communication. 

Specifically, the interface 2013 comprises an encoding/decoding circuit which 
performs an encoding/decoding according to NRZ code, a Manchester code. 
Miller code, a single polarity RZ code or the like, a modulator/demodulator 
which performs a modulation/demodulation in accordance with ASK 
15 (Amplitude Shift Keying), PSK (Phase Shift Keying), FSK (Frequency Shift 
Keying) or the like, and an anterma such as a dipole antenna, a microstrip 
antenna, a loop coil, a cored coil or the like for performing a signal 
transmission and reception using a fi^equency in a low frequency band or ISM 
band (Industry Science Medical band). A communication system used may 
20 comprise an electromagnetic induction system or a radio wave system, for 
example. 

[0154] The confidential value memory 201 1 is electrically connected with 
the read/write section 2012, which is in turn electrically connected with the 
interface 2013. While not shown in this Figure, the controller 2014 is 
25 electrically connected to various parts of the tag device 2010. 
<client apparatus> 

The client apparatus 2020 of this example comprises an interface 
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2022, a communication section 2021, a memory 2024a and a controller 2024. 

A products distribution information memory 121 is a magnetic 
recorder such as a hard disc unit, a flexible unit or the like, an optical disc unit 
such as DVD-RAM (Random Access Memory), CD-R (Recordable) / RW 
5 (Rewritable) or the like, a magneto-optical such as MO (Magneto-Optical 
disc) or the like, or a semiconductor memory such as EEPROM 
(Electronically Erasable and Programmable Read Only Memory), a flash 
memory or the like. The interface 2022 is a hardware which is similar to the 
example of the interface 2013. The communication section 2021 comprises 
10 LAN card, a modem, a terminal adapter or the like, and the controller 2023 is 
CPU (Central Processing Unit) of CISC (Complex Instruction Set Computer) 
type, RISC (Reduced Instruction Set Computer) type, or the like and 
including a memory 2023a. 

[0155] The interface 22 and the communication section 2021 are electrically 
15 connected together, and while omitted from illustration in this Figure, the 
controller 2024 is electrically connected to various parts of the client 
apparatus 2020. 

<updater> 

The security server 2060 comprises a communication section 2062 
20 (equivalent to "first input section" and "second output section"), a random 
number generator 2063, a read/write section 2064 (equivalent to "second 
read/write section"), a privileged ID memory 2061, a memory 2065a and a 
controller 2065. It is to be noted that the random number generator 2063, the 
read/write section 2964 and the privileged ID memory 2061 constitute - 
25 together "updating section". Specifically, the security server 2060 is 

constituted by a known computer of Neumann type which is formed by 
connecting together a CPU, an RAM, an ROM (Read Only Memory), an 
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extemal memory such as a magnetic recorder or an optical disc unit, a LAN 
card, a modem, a terminal adapter and like through busses, for example, and 
which executes a given program. Each of processing functions indicated 
below are implemented by CPU which reads a program stored in the RAM 
5 and executes a processing in accordance therewith. 
[0 1 56] <processing> 

Fig. 3 1 is a flow chart for describing a processing procedure of the 
present embodiment. A functional arrangement and a processing of the 
present embodiment will be described below with reference to Figs. 29 to 3 1 . 

10 It is to be understood that the tag device 2010, the client apparatus 2020 and 
the security server 2060 execute respective processings under the control of 
the controllers 2014, 2023 and 2065, respectively. Data which are processed 
are sequentially stored in the memory 2014a, 2023a or 2065a, which is 
accessed as a processing such as a calculation takes place, but a description 

15 for this will be omitted in the description to follow. 
[0157] <pre-processing> 

Privileged ID information in this example is a random value rn which 
is related to tag ID information idh- A random value rh corresponding to the 
tag ID information idh which is inherent to the tag device 2010 is stored as 

20 privileged ID information sidh in the confidential value memory 201 1 of the 
tag device 2010. Tag ID information id,, id^ which corresponds to each 
tag device 2010 and privileged ID information or random values r,, ■ • - , r^ 
which are related to the respective the tag ID information are stored in a 
privileged ID memory 2061 of the security server 2060. It is to be noted that h 

25 represents a natural number equal to or greater than 1 and equal to or less than 
m, and represents the number of each tag device 2010. m presents a total 
number of tag devices. 
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<privileged ID information updating processing> 
Initially, utilizing some sort of authentication technology, an 
authentication of each other is made between the client apparatus 2020 and 
security server 2060. A communication between the client apparatus 2020 and 
5 security server 2060 takes place under encryption according to some sort of 
encryption technology. 

[0158] An updating processing of the privileged ID information sidh is 
initiated by a trigger, which may be a passage through a location such as a 
porch which a man never fails to pass when he leaves a house, a number of 

10 times the privileged ID information stored in the tag device 2010 is used (a 
count reaching a given value) or the like. In response to the trigger, the client 
apparatus 2020 initially transmits a read command to the tag device 2010 
from its interface 2022 (step S301). This read command is received by the 
interface 2013 of the tag device 2010, and this triggers the read/write section 

15 2012 to extract the privileged ID information sidh from the confidential value 
memory 2011 (step S3 02). The extracted privileged ID information sidh is 
transmitted (delivered) from the interface 2013 to the client apparatus 2020 
(step S3 03). The privileged ID information sidh is received by the interface 
2022 of the client apparatus 2020, and is transmitted together with a 

20 solicitation to update the privileged ID information (a demand to re-privilege) 
by the communication section 2021 to the security server 2060 through the 
network 2070 (step 304). 

[0159] Information such as the privileged ID information (sidh) or the like is 
received by the communication section 62 of the security server 2060 (its 
25 input is accepted) (step S305), and is sent to a read/write section 2064. This 
also triggers the random number generator 63 (equivalent to "random value 
generator") to generate a random number rh' (step S3 06). 
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The generation of the random number rn* is carried out so as to avoid 
assuming a same value as privileged ID information in the privileged ID 
memory 2061. This generation takes place by using a pseudo-random number 
generating algorithm which is based on a calculation theory constructed with 
5 a one-way hash function such as SHA-1 , for example, or the like, and the 
generated random number rh' is sent to the read/write section 2064. The 
read/write section 2064 retrieves (selects) tag ID information idh 
corresponding to the privileged ID information sidh from the privileged ID 
memory 2061, relates the random number rh' (equivalent to "random value") 

10 as a new privileged ID information sidh' to the tag ID information idh, and 
stores it in the privileged ID memory 2061 (stepS307). In addition, the 
read/write section 2064 sends the new privileged ID information sidh - rh' to a 
communication section 2062, which then transmits the new privileged ID 
information sidh' to the client apparatus 2020 (equivalent to "delivered to tag 

1 5 device") through the network 2070 (step S308). 

[0160] The transmitted new privileged ID information sidh' is received by 
the communication section 2021 of the client apparatus 2020, and is 
transmitted to the tag device 2010 from the interface 2022 (step S309). The 
tag device 2010 receives the new privileged ID information sidh' at the 

20 interface 2013 (accepts an input) and sends it to the read/write section 2012, 
which sends the new privileged ID information sidh' to the confidential value 
memory 2011 to be stored therein (step S3 10). Subsequently, the tag device 
2010 sends this new privileged ID information sidh' to the backend apparatus 
2050 through the reader in response to a read demand from the reader (not 

25 shown). The backend apparatus 2050 sends the received privileged ID 
information sidh' to a database memory 1131, which receives it at its 
communication section 2062 and sends it to the read/write section 2064. The 
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read/write section 2064 retrieves a random value which coincides with the 
privileged ID information sidh* from the privileged ID memory 2061, reads 
out the tag ID information idh which is related to the coinciding random value 
rh and sends it to the communication section 2062, which then transmits it to 
5 the backend apparatus 2050. 

[0161] <features of embodiment 1 4> 

In the present embodiment, the privileged ID information which is 
stored in the tag device 2010 can be updated at arbitrary timing. This allows a 
tracing of the tag device 2010 on the basis of a common character of 

10 privileged ID information which remains in the history of communications or 
the like to violate the privacy to be avoided. Since a random value is used as 
privileged ID information, an attacker cannot know the association between 
privileged ID information before and after the update. Accordingly, a firm 
prevention of a tracing of the tag device 2010 can be realized. In addition, 

15 since a complicated re-privileging processing is performed in the security 
server 2060 which is external to the tag device 2010, there is no need to 
provide a circuit which would be required for purpose of re-privileging 
processing within the tag device 2010 itself. As a consequence, the cost of the 
tag device 2010 itself can be suppressed low. 

20 [0 1 62] [Embodiment 1 5] 

This embodiment is a modification of the embodiment 14, and differs 
from the embodiment 14 in that an encrypted text according to a common key 
encryption technique is used as privileged ID information. In the following, a 
distinction over the embodiment 14 will be principally described. 

25 Fig. 32 is a block diagram illustrating a functional arrangement of an 

updating system 2100 of the present embodiment. Fig. 33 is a flow chart for 
describing a processing procedure therefor. A functional arrangement and a 
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processing of the present embodiment will be described below with reference 
to these Figures. It is to be noted that arrangements which are common to the 
embodiment 14 are designated in Fig. 32 by like characters as used in Fig. 30. 
A security server 2160 executes various processings under the control of a 
5 controller 2065. A key memory 2161, a read/write section 2064 and an ID 
extractor 2166, an encryptor 2167 and a random number generator 2063 
constitute together "updating section". 
[0 1 63] <pre-processing> 

Privileged ID information of this mode represents information 

1 0 including a first encrypted text according to a common key encryption 

technique such as AES and a key ID information which corresponds to the 
common key used in this encryption. In this example, privileged ID 
information of a tag device 21 10 is defined as sidh=(ekj(idh | r), kidj) where h 
is a natural number equal to or greater than 1 and equal to or less than m, and 

15 represents the number corresponding to the tag device 2110 and j is a natural 
number equal to or greater than 1 and equal to or less than n and represents 
the number corresponding to each key. m represents a total number of tag 
devices and n represents a total number of keys. In addition, kj represents a 
j-th common key, kidj key ID information corresponding to the common key 

20 kj and r a random number. In addition, ek(a) represents an encrypted text 
which is obtained by encrypting a according to the common key encryption 
technique using a common key k, and a | p represents a bit combination of a 
and p. 

[0164] Privileged ID information sidh=(ekj(idh | r), kidj) which corresponds 
25 to tag ID information idh is stored in the confidential value memory 2111 of 
the tag device 21 10 of this example. Each key ID information (kid,, • • kid„) 
and a common key ( k, , • • k„ ) of the common encryption technology are 
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stored in a key memory 2161 of a security server 2160 (equivalent to 
"updater") in a manner relating to each other. In addition, information relating 
to the magnitude (bit length) and the padding position of a random number r 
appearing in sidh=(ekj(idh | r), kidj) is stored in a memory 2065a. 
5 [01 65] It is to be noted that in this example, it is assumed that the total 
number m of the tag devices is sufficiently greater than the total number of 
keys (m»n) such that identical key ID information is allotted to tag devices 
which are not related to each other. Specifically, for example, rather than 
allotting the identical key information to tag devices which are applied to a 

10 same variety of goods, the identical key ID information is allotted to tag 

devices which are applied to unrelated goods. In this manner, it is possible to 
prevent the variety of goods or a specific one of goods fi-om being identified 
on the basis of the key ID information. 

<privileged ID updating processing> 

15 In the similar manner an in the embodiment 14, the client apparatus 

2020 transmits a read command to the tag device 2110 initially (step S320). 
The tag device 2110 extracts privileged ID information (sidh=(ekj(idh | r), 
kidj)) from the confidential value memory 2111 (step S321), and transmits it 
to the client apparatus 2020 (step S3 22). In response thereto, the client 

20 apparatus 320 transmits the privileged ID information sidh together with a 
solicitation for update to the security server 2160 (step 323). 
[0166] Information including the privileged ID information sidh is received 
by the communication section 2062 of the security server 2160 (step S3 24), 
and the first encrypted text ekj(idh | r) which constitutes the privileged ID 

25 information sidh is sent to an ID extractor 2166 while the key ID information 
kidj is sent to the read/write section 2064. kidj is also recorded in the memory 
2065a. 
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Upon receiving the key ID information kidj, the read/write section 
2064 extracts the common key kj which corresponds to the key ID 
information kidj from the key memory 2161 and sends it to the ID extractor 

2166 (step S325). Upon receiving it, ID extractor 2166 decrypts the first 
5 encrypted text (ekj(idh | r) using the common key kj and extracts tag ID 
information idh. Specifically, the ID extractor 2166 calculates (idh | r) from 
idh=dkj(ekj(idh | r)), and extracts idh using information relating to the 
magnitude and the padding position of the random number r which is stored 
in the memory 2065a (step S3 26). Here, dk(a) represents a decryption of an 

10 encrypted text a with the common key k. The calculated tag ID information 
idh is sent to an encryptor 2167 together with the common key kj. The random 
number generator 2063 generates a random number r*, and sends it to the 
encryptor 2167 (step S327). Using the common key kj, the tag ID information 
idh and the random number r' which are sent thereto and information relating 

15 to the magnitude and the padding position of the random number which is 
stored in the memory 2065a, the encryptor 2167 generates (calculates) a 
second encrypted text (ekj(idh | r*)) (a second encrypted text being one, the 
association of which with the first encrypted text is difficult to follow), and 
sends it to the communication section 2062 (step S328). 

20 [0167] The communication section 2062 transmits (delivers) the encrypted 
text (ekj(idh | r')) which is sent thereto and the key ID information kidj in the 
memory 2065a as a new privileged ID information (sidh — (ekj(idh | r'), kidj)) 
(step S329). 

The new privileged ID information sidh* which is transmitted is 
25 received by the client apparatus 2020 through the network 2070 in the similar 
manner as in the embodiment 14, and is transmitted to the tag device 2110 
(step S330). The tag device 2110 receives the new privileged ID information 
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sidh at its interface 2013, and the read/write section 2012 stores it in the 
confidential value memory 2111 (step S331), and in response to a subsequent 
read command from the reader, sends the new privileged ID information sidh* 
to the backend apparatus 2050 through the reader. The backend apparatus 
5 2050 sends the received the privileged ID information sidh' to the security 
server 2160, which receives it at its communication section 2062. The 
security server 2 1 60 then decrypts the tag ID information by a procedure 
which is similar to steps S324 and 325, and sends it through the 
communication section 2062 and the network 2070 to the backend apparatus 

10 2050. 

[0 1 68] <features of embodiment 1 5> 

In the present embodiment, information including an encrypted text 
which is formed according to the common key encryption technique is used as 
privileged ID information, and accordingly, an attacker who does not know 

1 5 the common key cannot know an association of the privileged ID information 
before and after the update. In this manner, a firm prevention of a tracing of 
the tag device 2010 can be realized. 

While an encrypted text formed by an exclusive logical sum of the 
random number and ID constitutes privileged ID information in the present 

20 embodiment, the privileged ID information may be constituted by any other 
method as long as the property of probabiHty encryption (the property that if a 
same ID is encrypted with a same key, a different encrypted text can be 
delivered) is maintained. The same is true in an embodiment 16. 
[0169] [Embodiment 16] 

25 An embodiment 16 is a modification of the embodiment 14, and 

differs from the embodiment 14 in that an encrypted text formed according to 
a public key encryption technique is used as privileged ID information. A 
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distinction over the embodiment 14 will be principally described below. 

Fig. 34 is a block diagram illustrating a functional arrangement of an 
updating system 2200 of the present embodiment, and Fig. 35 is a flow chart 
for describing a processing procedure therefor. A functional arrangement and 
5 a processing according to the present embodiment will be described below 
with reference to these Figures. It is to be noted that in Fig. 34, arrangements 
which are common to the embodiment 14 are designated by like characters as 
used in the embodiment 14. A read/write section 2064, a key memory 2261, 
an ID extractor 2266, an encryptor 2267 and a random number generator 2063 

10 constitute together an "updating section". 
[0 1 70] <pre-processing> 

Privileged ID information in this mode comprises information 
including a first encrypted text according to an public key encryption 
technique such as RSA and a key ID information which corresponds to the 

15 public key used in the encryption. In this example, privileged ID information 
of a tag device 2210 is defined as sidh=(epkj(idh | r), kidj). It is to be 
understood that pkj represents a j-th public key, kidj key ID information which 
corresponds to the public key pkj and epk(a) an encrypted text formed by 
encrypting a according to the public key encryption technique using the 

20 public key pk. 

[0171] Privileged ID information sidh=(epkj(idh | r), kidj) is stored in a 
confidential value memory 2211 of the tag device 2210 of this example. Each 
key ID information ( kidj , • • - , kid„ ), a common key ( sk, , • • • , sk„ ) and a 
public key ( pk, , • • • , pk„ ) of the public key encryption technique (a key pair 

25 (skj, pkj)) are stored in a manner relating to each other in a key memory 2261 
of a security server 2260 (equivalent to "updater"). Information relating to the 
magnitude (bit length) and the padding position (bit position) of the randorn 
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number r in sidh=(epkj(idh | r), kidj) are stored in a memory 2065a of this 
example. 

[0172] In the similar manner as in the embodiment 15, in this example, an 
identical key ID information is allotted to unrelated tag devices. This allows 
5 the variety of goods or a specific one of goods to be prevented fi*om being 
identified on the basis of the key ID information. 

<privileged ID updating processing> 

In the similar manner as in the embodiment 14, a client apparatus 
2020 initially transmits a read command to the tag device 2210 (step S340). 

10 The tag device 2210 extracts privileged ID information sidh=(epkj(idh | r), 

kidj) fi^om the confidential value memory 2211 (step S341), and transmits it to 
the client apparatus 2020 (step S3 42). In response thereto, the client apparatus 
2020 transmits the privileged ID information sidh together with a solicitation 
for update to the security server 2260 (step 343). 

15 [0 1 73] Information including the privileged ID information sidh or the like 
is received by the communication section 2062 of the security server 2260 
(step S344), and the first encrypted text epkj(idh | r) which constitutes the 
privileged ID information sidh is sent to the ID extractor 266 while the key ID 
information kidj is sent to the read/write section 2064. The key ID information 

20 kidj is also recorded in the memory 2065a. 

Upon receiving the key ID information kidj, the read/write section 
2064 extracts a secret key skj and a public key pkj (or key pair) which 
corresponds to the key ID information kidj fi-om the key memory 2261, and 
sends the secret key skj to the ID extractor 2266 and sends the public key pkj 

25 to the encryptor 2267, respectively (step S345). Upon receiving the secret key 
skj, the ID extractor 2266 decrypts the first encrypted text epkj(idh | r) using 
the secret key skj, and extracts tag ID information idh- Specifically, (idh | r) is 
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calculated according to idh=dskj(epkj(idh | r)), and idh is calculated using 
information relating to the magnitude and the padding position of the random 
number r in the memory 2065a (step S346). Here, dsk(a) represents a 
decryption of an encrypted text a with the secret key sk. The calculated tag ID 
5 information idh is sent to the encryptor 2267. The random number generator 
2063 generates a random number r', and sends it to the encryptor 2267 (step 
S347). Using the public key pkj, the tag ID information idh and the random 
number r' which are sent thereto and information relating to the magnitude 
and the padding position of the random number, the encryptor 2267 generates 

10 (calculates) an encrypted text (epkj(idh | r')) (a second encrypted text, the 
association with the first encrypted text of which is difficult to follow), and 
sends it to the communication section 2062 (step S348). 
[0174] The communication section 2062 transmits (delivers) the second 
encrypted text (epkj(idh | r')) which is sent thereto and the key ID information 

15 kidj in the memory 2065a as a new privileged ID information sidh*=(epkj(idh | 
r'), kidj) (step S349). 

The transniitted new privileged ID information sidh' is received by 
the client apparatus 2020 through the network 2070 in the similar manner as 
in embodiment 14, and is transmitted to the tag device 2210 (step S350). The 

20 tag device 2210 causes its read/write section 2012 to store the new privileged 
ID information sidh in the confidential value memory 2211 (step S351). In 
response to a subsequent read command from the reader, this new privileged 
ID information sidh' is sent to the backend apparatus 2050 through the reader. 
The backend apparatus 2050 sends the received privileged ID information 

25 sidh* to the security server 2260, which then receives it by the communication 
section 2062, Subsequently, the security server 2260 decrypts tag ID 
information by a procedure similar to steps S345 and 346, and sends it to the 
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backend apparatus 2050 through the communication section 2062 and the 
network 2070. 

[0175] <features of embodiment 16> 

Since information containing an encrypted text formed according to 
5 the public key encryption technique is used as privileged ID information in 
the present embodiment, an attacker who does not know the secret key cannot 
know the association between the privileged ID information before and after 
the update. In this manner, a firm prevention of a tracing of the tag device 
2210 can be realized. 

10 [Embodiment 17] 

This embodiment is a modification of the embodiment 14, and differs 
from the embodiment 14 in that privileged ID information is updated using an 
encryption algorithm having the property of re-encryption (the property of an 
encryption capable of generating a different encrypted text data only using 

1 5 encrypted data and the public key. A decryption takes place by using the same 
secret key). A distinction over the embodiment 14 will be principally 
described below. 

[0176] Fig. 36 is a block diagram illustrating a functional arrangement of an 
updating system 2300 of the present embodiment, and Fig. 37 is a flow chart 

20 for describing a processing procedure therefor. A functional arrangement and 
a processing of the present embodiment will be described below with 
reference to these Figures. It is to be noted that in Fig. 36, arrangements 
which are common with the embodiment 14 are designated by like characters 
as used in the embodiment 14. A security server 2360 executes various 

25 processings under the control of a controller 2065. A key memory 2361, a 
read/write section 2064, a random number generator 2063, a remainder 
multiplication calculator 2366 and a remainder power calculator 2367 
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constitute together an "updating section". 
[0 1 77] <pre-processing> 

Privileged ID information according to this mode is information 
including a first encrypted text according an encryption algorithm (public key 
5 encryption technique) which has the property of re-encryption, and key ID 
information which corresponds to the public key used in the encryption. In 
this example, ElGamal encryption (see Tatsuaki Okamoto and Hirosuke 
Yamamoto, "Modem encryption", 1998, pi 18 — 119, for example) is used, 
and privileged ID information of a tag device 23 10 is defined as 

10 sid^ = (g"^ mod p, id^ • pkj mod p, kidj) . Here, g represents a publicized 
element of generation, p a sufficiently large primary number, r an arbitrary 
integer equal to or greater than 0 and equal to or less than p-1 , pkj=g^^ mod p a 
j-th public key, skj a j-th secret key, and (g*^ mod p, idh'pkj'"mod p) an 
encrypted text. It is to be noted that super-index "skj" in pkj=g^^^ mod p means 

15 "skj". In the description to follow and associated Figures, "mod p" will be 
omitted from description. 

[0178] Privileged ID information sid^ = (g\ id^ - pkj, kidj) is stored in a 

confidential value memory 23 1 1 of the tag device 23 10 of the present 

example. In addition, each key ID information (kidp • • •, kid^ ) and a pubic 
20 key (pk,, • • •, pk„ ) are stored in a key memory 2361 of a security server 2360 

(equivalent to "updater") in a manner relating to each other. An element of 

generation g is stored in a memory 2065a. 

Again in this example, an identical key ID information is allotted to 

unrelated tag devices. This allows an identification of the variety of goods or 
25 a particular one of goods on the basis of the key ID information to be 

prevented. 

[0 1 79] <privileged ID updating processing> 
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In the similar manner as in the embodiment 14, a client apparatus 
2020 initially transmits a read command to the tag device 23 10 (step S3 60). 
The tag device 2310 extracts privileged ID information 
sidh = (g", idj, • pkj, kidj) from the confidential value memory 23 1 1 (step 
5 S361), and transmits it to the client apparatus 2020 (step S362). In response 
thereto, the client apparatus 2020 transmits the privileged ID information sidh 
together with a solicitation to update to the security server 2260 (step S3 63). 
[0180] Information inclusive of the privileged ID information sidh is 
received by the communication section 2062 of the security server 2360 (step 
10 S3 64), and (g^, idh pkj*^) which constitutes the privileged ID information sidh is 
sent to a remainder multiplication calculator 2366 (which constitutes 
"encrypting section'') while kidj is sent to the read/write section 2064. kidj is 

also recorded in the memory 2065a. 

Upon receiving key ID information kidj, the read/write section 2064 

1 5 extracts a public key pkj which corresponds to this key ID information kidj 

from the key memory 2361, and sends it to a remainder power calculator 2367 
(which constitutes "encrypting section") (step S365). This triggers the random 
number generator 2063 to generate a random number r' which is equal to or 
greater than 0 and equal to or less than p-1, and to send it to the remainder 

20 power calculator 2367 (step S366). The remainder power calculator 2367 

r' r' 

calculates (g , pkj ) using the element of generation g in the memory 2065a, 
the public key pkj and the random number r' which are received, and sends a 
result of calculation to the remainder multiplication calculator 2366 (step 
S367). The remainder multiplication calculator 2366 calculates (g'^^^ 
25 idh-pkj"^^"^) using (g"^, pkj'^) and (g'^, idh-pkj*^) which are received, and sends a 
result of calculation as an encrypted text (a second encrypted text) to the 
conmiunication section 2062 (step S368). 
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[0181] The communication section 2062 transmits the sent encrypted text 
(g'^'', idh'pkj'^^) (a second encrypted text, the association with the first 
encrypted text of which is difficult to follow) and key ID information kidj in 

the memory 2065a as new privileged ID information (sidj^ = (g*^^^ 
5 ,id,.pkf^kid-))(stepS369). 

The transmitted new privileged ID information sidh' is received 
through the network 2070 by the client apparatus 2020 in the similar manner 
as in the embodiment 14, and is transmitted to the tag device 23 10 (step S3 70). 
The read/write section 2012 of the tag device 23 10 then stores the new 

10 privileged ID information sidh* in the confidential value memory 23 1 1 (step 
S3 71). Subsequently, the tag device 23 10 responds with this new privileged 
ID information (sidh*) in response to a subsequent read command. 
[0 1 82] <features of embodiment 1 7> 

In this embodiment, privileged ID information is updated using an 

15 encryption algorithm having a property of re-encryption, and accordingly, the 
privileged ID information can be updated without decrypting ID in plain text. 
Consequently, there is no likelihood that ID be eavesdropped during the 
updating processing of privileged ID information and a firm prevention of a 
tracing of the tag device 23 10 can be realized. 

20 While a public key (pk^, • • - , pk„ ) is stored in the key memory 2361 

of the security server 2360 in the present embodiment, an arrangement can be 
used in which the security server 2360 does not maintain the pubic key 
( pk, , • • " , pk„ ), but acquires the public key ( pkj , • • • , pk^ ) from a given 
public key server for use. 

25 [0183] While ElGamal encryption is used in the present embodiment, a 
different algorithm such as a higher order remainder encryption may also be 
used provided it is an encryption algorithm having the property of 
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re-encryption. 

In addition, as modifications of the embodiment 16 and the 
embodiment 17, the tag ID information may be encrypted with a common key, 
and an encrypted text of the common key and tag ID information may be 
5 encrypted with the pubhc key according to the above mentioned public key 
encryption technique to provide privileged ID information (hybrid encryption). 
In this instance, the security server acquires the common key by decrypting 
the privileged ID information with the secret key which corresponds to this 
public key, and decrypts the encrypted text of tag ID information using this 
10 common key to obtain tag ID information. Subsequently, the security server 
generates a separate encrypted text form this tag ID information according to 
the common key encryption technique, and the common key and the 
encrypted text may be further encrypted according to the public encryption 
technique. The resulting encrypted text may be used as a new privileged ID 
1 5 information to be retumed to a client apparatus. Subsequently, this new 

privileged ID information is stored in the confidential value memory of the 
tag device in the similar as in the embodiment 16 or the like. 
[0 1 84] [Embodiment 1 8] 

In an embodiment 18, a security server is changed at the time the 
20 privileged ID information is updated. A distinction over the embodiment 14 
will be principally described below. 

Fig. 38 is a conceptual view illustrating an overall arrangement of an 
updating system 2400 of the present embodiment. It is to be noted that in Fig. 
38, arrangements which are common with the embodiment 14 are designated 
25 by like characters as used in the embodiment 14. 

As illustrated in this Figure, the updating system 2400 comprises a 
tag device 2410, a client apparatus 2020 (equivalent to "update solicitor"), a 
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plurality of security servers 2460-1 ~ v (equivalent to "updaters") and a 
backend apparatus 2050, which are connected together to enable a 
commutation therebetween through the network 2070. 

[0185] Fig. 39 is a block diagram illustrating a functional arrangement of an 
5 updating system 2400 of the present embodiment, and Fig. 40 is a flow chart 
for describing a processing procedure therefor. A functional arrangement and 
a processing according to the present embodiment will be described below 
with reference to these Figures. It is to be noted that in Fig. 39, arrangements 
which are common with the embodiment 14 are designated by like characters 

10 as used in the embodiment 14. For brevity of illustration, only two security 
servers 2460-1 and 2460-2 are shown in Figs. 38 and 39, but it should be 
understood that more than two security servers may be used to construct a 
system. In addition, while only processing function/data which are required 
for purpose of description are indicated in Fig. 39, it should be understood 

15 that either one of the security servers 2460-1 and 2460-2 may also contain 
processing functions and data which the other security server contains. The 
security servers 2460-1 and 2460-2 execute respective processings under the 
control of controllers 2465-1 and 2465-2. 
[0 1 86] <pre-processing> 

20 Privileged ID information according to this mode is information 

including an encrypted text according to the public key encryption technique 
and key ID information which corresponds to the public key used in the 
encryption. In the present example, privileged ID information of the tag 
device 2410 is defined as sidh=(epkj(idh), kidj). 

25 This privileged ID information sidh=(epkj(idh), kidj) is stored in the 

confidential value memory 241 1 of the tag device 2410 of this example. Each 
key ID information ( kid, , • • • , kid„ ) and a secret key ( skj , • • , sk„ ) of the 
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public key encryption technique are stored in a key memory 2461-1 of the 
security server 2460-1 in a manner relating to each other. Also, each key ID 
information ( kidj , • • • , kid„ ) and a public key ( pk, , • • • , pk„ ) of the public 
key encryption technique are stored in a key memory 2461-2 of the security 
5 server 2460-2 in a manner relating to each other. 

[0187] In this example also, an identical key ID information is allotted to 
unrelated tag devices. This allows the variety of goods or a particular one of 
the goods to be prevented from being identified on the basis of the key ID 
information. 

1 0 <privileged ID updating processing> 

In the similar as in the embodiment 14, a client apparatus 2020 
initially transmits a read command to tag device 2410 (step S3 80). The tag 
device 2410 extracts the privileged ID information (sidh=(epkj(idh), kidj)) 
from the confidential value memory 241 1 (step S3 81) and transmits it to the 

15 client apparatus 2020 (step S3 82). In response thereto, the client apparatus 
2020 causes its communication section 2021 (equivalent to "first ID output 
section") to transmit (deliver) the privileged ID information sidh extracted 
from the tag device 2410 together with a solicitation to update to the security 
server 2460-1 (step 383). It is to be noted that the security server 2460-1 is the 

20 security server which controls the privileged ID information stored in the tag 
device 2410 at this point in time. 

[0188] Information inclusive of the privileged ID information sidh is 
received by a communication section 2462-1 (equivalent to "first input 
section'') of the security server 2460-1 (step S3 84), and epkj(idh) which 
25 constitutes the privileged ID information sidh is sent to an ID extractor 2466-1 
while kidj is sent to a read/v^ite section 2464-1 . Upon receiving the key ID 
information kidj, the read/write section 2464-1 extracts a secret key skj which 
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corresponds to the key ID information kidj from the key memory 2461-1 and 
sends it to the ID extractor 2466-1 (step S385). Upon receiving the secret key 
skj, the ID extractor 2466-1 decrypts an encrypted text epkj(idh) using the 
secret key skj to determine tag ID information idh (idh=dskj(epkj(idh))) (step 
5 S3 86). The tag ID information idh which is thus determined is sent to a 

communication section 2462-1 (equivalent to "second output section"), and 
thence transmitted (delivered) to the client apparatus 2020 through the 
network 2070 (step S387). 

[0189] The tag ID information idh delivered from the security server 2460-1 
10 is received by the communication section 2021 of the client apparatus 2020 
(accepted as an input) (step S3 88). Subsequently, the conmiunication section 
2021 transmits (delivers) the tag ID information idh to an arbitrarily selected 
security server 2460-2 to solicit to update the privileged ID information (step 
S389). 

15 The communication section 2462-2 (equivalent to "third input 

section") of the security server 2460-2 receives this tag ID information idh, 
(accepts as an input) which is transmitted through the network 2070 and sends 
it to an encryptor 2467-2 (step S3 90). This triggers a key selection by a key 
selector 2468-2, and such information is sent to a read/write section 2464-2 

20 (step S391). In the present example, the key selector 2468-2 selects an 
arbitrary key number i (such as a random number) from natural numbers 
equal to or greater than 1 and equal to or less than n, and sends this key 
number i to the read/write section 2464-2. The read/write section 2464-2 
extracts key ID information kidi and the public key pki which correspond to 

25 the received key number I from the key memory 2461-2, and sends them to 
the encrj^tor 2467-2 (step S392). The encryptor 2467-2 encrypts (privileges) 
the tag ID information idh using the received public key pkj (epki(idh)), and 
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generates a new privileged ID information (sidh'=(epki(idh), kidi)) which 
comprises the encrypted text and the key ID information kidj (step S3 93). The 
generated privileged ID information sidh* is sent to the communication section 
2462-2, and the communication section 2464-2 (equivalent to "third output 
5 section") transmits (delivers) this privileged ID information sidh' to the client 
apparatus 2020 through the network 2070 (step S394). 
[0190] The client apparatus 2020 receives the privileged ID information 
(sidh*) (accepts as an input) by its conamunication section 2021 (equivalent to 
"second input section") (step S395), and transmits it through the interface 

10 2022 to the tag device 2410 (step S396). The tag device 2460 stores the new 
privileged ID information sidh in the confidential value memory 2411 (step 
S3 97), and responds with the new privileged ID information sidh' in response 
to a subsequent read demand. Hereafter, the security server 2460-2 acts as the 
security server which controls the privileged ID information stored in the tag 

15 device 2410. Accordingly, a decryption of the new privileged ID information 
sidh* takes place in the security server 2460-2 subsequently. Tag ID 
information idh which represents a result of decrypting operation will be sent 
to the client apparatus 2020, the backend apparatus 2050 or the like. A 
decryption of the privileged ID information sidh' in the security server 2460-2 

20 takes place using the secret key ski stored in a key memory 2461-2 (a secret 
key corresponding to kidi, not shown). 
[0191] <features of embodiment 1 8> 

It will be seen that in the embodiment 18, privileged ID information 
is decrypted by the security server 2460-1 which controls the privileged ID 

25 information in the tag device 2410, and the security server 2460-2 which is 
separate generates new privileged ID information to update the privileged ID 
information stored in the tag device 2410. In other words, an updating of the 
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privileged ID information takes place simultaneously with changing the 
security server which controls the privileged ID information in the tag device 
2410. This prevents a concentration of information relating to a history of 
updating the privileged ID information in a single security server, allowing 
5 the risks of information leaking from the security server and of a tort by a 
security server which is set up with a malignant intention to be alleviated. By 
making the changed security server to be a local one which the public has no 
access, a higher level of safety can be realized. 

[0192] The updating system of the present embodiment may be constructed 
10 with the common key encryption technique rather than the public key 
encryption technique. 

Alternatively the updating system of the present embodiment may be 
constructed by applying the mode such as the embodiment 14 in which a 
random value is used in the privileged ID information. In this instance, the 
15 new security server generates a random value in place of the encryption 

mentioned above, and adds the generated random value (privileged ID) and 
ID anew to the privileged ID memory as used in the embodiment 14. 
[Embodiment 19] 

In an embodiment 19, re-privileging processing of the privileged ID 
20 information is performed by a client apparatus. Thus the client apparatus 
functions as an updater. In this instance, the client apparatus performs a 
re-privileging processing of the privileged ID information which is directly 
read out. 

[0193] Fig. 41 is a block diagram illustrating a functional arrangement of an 
25 updating system 2500 of the present embodiment and Fig. 42 is a flow chart 
for describing a processing procedure therefor. A functional arrangement and 
a processing according to the present embodiment will be described below 
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with reference to these Figures. It should be noted that characters as used in 
the embodiment 14 are applied to arrangements in Fig. 41 which are common 
with the embodiment 14. A distinction over the embodiment 14 will be 
principally described below. 
5 <pre-processing> 

The privileged ID information of the present embodiment is an 
information including an encrypted text formed with an encryption algorithm 
(the public key encryption technique) having the property of re-encryption, 
and the key ID information which corresponds to the public key used in the 
10 encryption. In the present example, ElGamal encryption is used, and the 
privileged ID information in a tag device 2510 is defined as 
sidh=(g%idh-pk;,kidj). 

[0194] This privileged ID information (sid|^ = (g% id^ • pkj, kidj) ) is stored 

in the memory 25 1 1 of the tag device 25 10 of this example. Each key ID 
15 information (kidi, • • - , kid„) and a public key (pk^, • • pk^ ) are stored in the 

key memory 2524 of the client apparatus 2520 (equivalent to "updater") in a 

manner relating to each other. An element of generation g is stored in a 

memory of a remainder multiplication calculator 2527. 

Also in this example, an identical key ID information is allotted to 
20 unrelated tag devices. This prevents the variety of goods or a particular one of 

goods fi^om being identified on the basis of the key ID information. 

[0 1 95] <privileged ID updating processing> 

The client appsiratus 2520 executes processings indicated below 

under the control of a controller 2023. 
25 In the similar manner as in the embodiment 14, initially the client 

apparatus 2520 transmits a read command to the tag device 25 10 (step S400). 

The tag device 2510 extracts the privileged ID information 
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(sid,^ = (g% idjj • pkj, kidj) ) from the memory 25 1 1 (step S401), and transmits 
it to the client apparatus 2520 (step S402). 

This privileged ID information sidh is received by the interface 2022 
of the client apparatus 2520 (step S403), and an encrypted text (g"", idh-pkj"^) 
5 which constitute the privileged ID information sidh is sent to the remainder 
multiplication calculator 2528 (which constitutes an "encryptor") while kidj is 
sent to a read/write section 2525. kidj is also recorded in a memory 2023a. 
[0196] Upon receiving the key ID information kidj, the read/write section 
2525 extracts the public key pkj which corresponds to this key ID information 

10 kidj from the key memory 2524, and sends it to a remainder power calculator 
2527 (which constitutes an "encryptor") (step S404). This triggers the random 
number generator 2526 to generate a random number r' which is equal to or 
greater than 0 or equal to or less than p- 1 , which is then sent to the remainder 
power calculator 2527 (step S405). The remainder power calculator 2527 

15 calculates (g"^ , pkj*^ ) using the element of generation g within its own memory, 
the received public key (pkj) and the random number r', and sends its result to 
the remainder multiplication calculator 2528 (step S406). The remainder 
multiplication calculator 2528 calculates (g'^^ idh-pkj'^^'^) using received (g^ 
pkj"^ ) and (g^ idh pkjO, and sends a result of calculation as a new encrypted text 

20 to the interface 2022 (step S407). The interface 2022 transmits (delivers) the 
encrypted text (g*^^ , idh pkj^^^) which is sent thereto and key ID information 
kidj in the memory of the interface 2022 as new privileged ID information 
(Sid; =(g^^^ id, .pkp', kidj)) (step S408). 

[0197] The transmitted new privileged ID information sidh' is received by 
25 the interface 2013 of the tag device 2510, and is stored in the memory 25 1 1 
through the read/write section 2012 (step S409). Subsequently, in response to 
a read demand, the tag device 2510 responds with this new privileged ID 
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information sidh*. 

<features of embodiment 19> 

In the embodiment 19, the client apparatus 2520 re-privileges the 
privileged ID information within the tag device 25 1 0. The client apparatus 
5 2520 applies the re-privileging processing only to the privileged ID 

information which is directly read out by the interface 2022. This suppresses a 
leakage of information to a third party, securing a higher level of safety. 
[0198] While the public key ( pk, , • • , pk„ ) is stored in the key memory 
2524 of the security server 2520 in the present embodiment, an arrangement 
10 may be used in which the security server 2520 does not carry the public key 
( pkj , • • • , pk„ ), but acquires the public key ( pk^ , • • • , pk^^ ) from a given 
public key server for use. 

The arrangement of the security server shown in either mode from 
the embodiment 14 to the embodiment 16 may be applied to the client 
15 apparatus 2520 to execute processings of the present embodiment. 
[Embodiment 20] 

An embodiment 20 will now be described. 
[0199] In this embodiment, a client apparatus (equivalent to "update 
solicitor") previously acquires a plurality of privileged ID information, and 

20 selects one therefrom to be used in updating the privileged ID information 
within the tag device. 

Fig. 43 is a block diagram illustrating a ftmctional arrangement of an 
updating system 2600 of the present embodiment, and Fig. 44 is a flow chart 
for describing a processing procedure therefor. A functional arrangement and 

25 a processing of the present embodiment will be described below with 
reference to these Figures. It is to be noted that in Fig. 43, arrangements 
which are common with the embodiment 14 are designated by like characters 
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as used in the embodiment 14. A distinction over the embodiment 14 will be 
principally described below. 
[0200] <pre-processing> 

Initially, the communication section 202 1 (equivalent to "privileged 
5 ID input section") of the client apparatus 2620 receives (accepts as input) a 
plurality of kinds of privileged ID information (sidh-1 , • • • , p) which are sent 
through the network 2070 (step S410). The plurality of kinds of privileged ID 
information (sidh- 1 , • • - , p) are those which are obtained by repeating the 
method described in either one of the embodiment 14 to the embodiment 17 

10 or by transmitting a plurality of kinds of privileged ID information in one 
operation from the security server 2660. When utilizing the method of the 
embodiment 14, it is necessary that a plurality of privileged ID information 
(sidh-1, • • , p) be stored in the privileged ID memory of the security server 
2660 for one tag ID information. By contrast, when utilizing the method in 

15 either one of the embodiment 15 to embodiment 17, information which is 

stored in the security server 2660 may be similar to one of the embodiment 15 
to the embodiment 17. 

[0201] The communication section 2021 sends these privileged ID 
information (sidh- 1 , • • • , p) to the read/write section 2624, which then store 
20 them in the privileged ID memory 2625 (step S41 1). 
<privileged ID updating processing> 

The client apparatus 2620 executes the processings described below 
under the control of the controller 2023. 

Initially, the controller 23 determines whether or not there existed a 
25 given trigger (opportunity) to update the privileged ID information (step 
S412). What can be cited as such a trigger are that the privileged ID 
information has been read from the tag device 2610, that a count indicating a 
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number of times the privileged ID information within the tag device 2610 has 
been used has reached a given value or the like. In the absence of a given 
trigger, a determination rendered at step S412 is continued, and in the 
presence of a given trigger, the read/write section 2624 (equivalent to 
5 "privileged ID extractor") extracts one privileged ID information sidh-j from 
the privileged ID memory 2625 (step S413). The selection of this one 
privileged ID information sidh-j may take place at random, or may be in the 
sequence of an array in the manner of sidh-1, sidh-2, • • • and retuming to 
sidh-1 again after sidh-p. The extracted one privileged ID information sidh-j is 
10 sent from the read/vmte section 2624 to the interface 2022 (equivalent to 

"privileged ID output section''), and thence transmitted (delivered) to the tag 
device 2610 (step S414). 

[0202] The tag device 2610 receives this privileged ID information sidh-j at 
its interface 2013 (step S415), and stores it in a confidential value memory 
15 261 1 through the read/write section 2012 (step S416). Subsequently, the tag 
device 2610 responds with this new privileged ID information sidh' in 
response to a read command from the reader. 
<features of embodiment 20> 

In the present embodiment, a plurality of kinds of privileged ID 
20 information are previously stored in the client apparatus 2620, and the 

privileged ID information in the tag device 2610 is updated by the privileged 
ID information which is selected from the stored ones. The selection of the 
privileged ID information which is used in updating takes place within the 
client apparatus 2620, and its transmission takes place locally between the 
25 client apparatus 2620 and the tag device 2610. Accordingly, a leakage of 
information to a third party can be suppressed, securing a higher level of 
safety. If the transmission of the plurality of kinds of privileged ID 
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information takes place in one operation from the security server 2660 to the 
client apparatus 2620, a number of times the security server 2660 is accessed 
can be reduced, thus alleviating a degradation in the performance of the 
system which is associated with the updating processing of the privileged ID 
5 information. 

[0203] It should be noted that the opportunity for selecting/storing the 
privileged ID information is not limited to the one mentioned above, and an 
arrangement may be used in which after the privileged ID information stored 
in the client apparatus 2620 have been exhausted, a plurality of kinds of 
10 privileged ID information may be acquired again from the security server 
2660 to be stored in the client apparatus 2620. 
[Embodiment 21] 

An embodiment 21 will now be described. 

This embodiment is a modification of the embodiment 20, and differs 
15 from the embodiment 20 in that the client apparatus acquires the privileged ID 
information delivered from a plurality of security servers ("updaters"). 
[0204] Fig. 45 is a block diagram illustrating a fimctional arrangement of an 
updating system 2770 of the present embodiment. A fimctional arrangement 
and a processing of the present embodiment will be described below with 
20 reference to this Figure. It is to be noted that in Fig. 45, arrangements which 
are common with the embodiment 14 or the embodiment 20 are designated by 
like character as used in the embodiment 14 or the embodiment 20. Only a 
distinction over the embodiment 20 will be described below. 
<pre-processing> 

25 The only difference over the embodiment 20 resides in that a client 

apparatus 2620 receives a plurality of kinds of privileged ID information 
(sidh- 1 , • • • , p) which are sent from a plurality of security servers 2760- 1 , 
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2760-2, • • , 2760-p. Privileging of ID in the plurality of security servers 
2760- 1 , 2760-2, • • • , 2760-p takes place according to the method of the 
embodiment 18, for example. 
[0205] <privileged ID updating processing> 
5 This remains to be similar to the embodiment 20. 

<features of embodiment 21> 

In the present embodiment, the client apparatus 2620 acquires the 
privileged ID information which is generated by the plurality of security 
servers 2760- 1 , 2760-2, • • , 2760-p. Accordingly, a concentration of the 
10 history of updating the privileged ID information in one security server can be 
prevented, realizing a higher level of safety. 

[0206] As mentioned above, when the method of the embodiment 14 is 
utilized to generate privileged ID information in the embodiment 20, there has 
been a need to hold a plurality of privileged ID information (sidh- 1 , • • • , p) for 

15 one key ID information in the privileged ID memory of the security server. 
However, in the present embodiment, even though the method of the 
embodiment 14 is utilized to generate privileged ID information, the 
privileged ID information which is controlled by each security server may be 
only one privileged ID information for one key ID information. In this respect, 

20 a control of the privileged ID information can be simplified. 
[Embodiment 22] 

An embodiment 22 will now be described. 
[0207] This embodiment is a modification of the embodiment 20 and the 
embodiment 21, and in this modification, a plurality of privileged ID 
25 information which are acquired is stored in a tag device rather than in a client 
apparatus. 

Fig. 46 is a block diagram illustrating a functional arrangement of an 
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updating system 2800 of the present embodiment. A functional arrangement 
and a processing of the present embodiment will be described below with 
reference to this Figure. It is to be noted that in Fig. 46, arrangements which 
are common with the embodiment 14 are designated by like characters as 
5 used in the embodiment 14, A distinction over the embodiment 14, the 

embodiment 20 and the embodiment 21 will be principally described below. 
<pre-processing> 

Initially, a communication section 2021 of a client apparatus 2020 
receives a plurality of kinds of privileged ID information (sidh-1, " • • , p) 
10 which are sent through the network 2070. The plurality of kinds of privileged 
ID information (sidh-1, • p) which are received are sent to an interface 
2022, and thence transmitted to a tag device 2810. 

[0208] The tag device 2810 receives (accepts as input) the plurality of kinds 
of privileged ID information (sidh-1, • • • , p) at its interface 2013 (equivalent 

15 to "privileged ID input section"), and sends them to a read/write section 2012, 
which then stores them in a privileged ID memory 28 1 1 . It is to be noted that 
the privileged ID information (sidh-1 , • • , p) may be ones which are sent from 
a single security server or ones which are delivered from a plurality of 
security servers. 

20 <privileged ID updating processing> 

The read/write section 2012 of the tag device 2810 (equivalent to 
"privileged ID extractor") extracts one privileged ID information (sid,^-j) 
arbitrarily (for example, at random) from the privileged ID memory 281 1 
under the control of a controller 2014 in response to a trigger (opportunity) 

25 which may be a read command from a reader, for example, and transmits it 
from an interface 2013. The transmitted privileged ID information (sidh-j) is 
used in a processing by the backend apparatus as described above in 
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connection with the embodiment 14. 
[0209] <features of embodiment 22> 

In the present embodiment, a plurality of kinds of privileged ID 
information (sidh- 1 , are stored in the tag device 28 1 0, and one 

5 privileged ID information (sidh-j) which is selected therefrom is used. This 
avoids that the privileged ID information which is used in the acquisition of 
information relating to ID be identical with each other during each run, thus 
allowing a tracing of the tag device 2810 to be suppressed. Since the plurality 
of kinds of privileged ID information (sidh-1 , • • • , p) are stored in the tag 

10 device 2810 itself, the privileged ID information which is used can be updated 
if an access to the client apparatus 2020 cannot be made (as when a reading 
processing is performed in a tag reader which does not have the function of a 
client apparatus 2020, for example). 
[02 1 0] [Embodiment 23] 

15 In this embodiment, a tag device is provided with a confidential 

value memory having a read-only region in which key ID information is 
stored and a rewritable region in which a first privileged ID information is 
stored. When re-privileging processing of the privileged ID information is 
made, key ID information and the first privileged ID information are extracted 

20 from the privileged ID memory to be delivered. 

An updater accepts the key ID information and the first privileged ID 
information as inputs, and extracts a key which corresponds to the key ID 
information. Using the extracted key and the first privileged ID information, it 
generates a second privileged ID information, the association with the first 

25 privileged ID information of which is difficult to follow, and this second 
privileged ID information is delivered. 

[021 1] A tag device accepts the second privileged ID information as an 
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input and stores the second privileged ID information which is input in the 
rewriteable region of the privileged ID memory. 

What is updated by the updater is only the privileged ID information. 
And what is rewritten in the tag device is only the privileged ID information 
5 in the rewritable region, and there is no change in the key ID information in 
the read-only region. Accordingly, if the privileged ID information in the 
rewritable region is rewritten to a privileged ID information which 
corresponds to a different tag device, the key ID information which is used in 
a decrypting processing of the privileged ID information remains unchanged 

10 from the original key ID information. For this reason, a decrypting server 

which is selected when decrypting the rewritten privileged ID information is a 
decrypting server which is selected on the basis of the original key ID 
information, for example, and it is possible that a decrypting processing of the 
rewritten privileged ID information may not be appropriately achieved. If the 

15 decrypting server were in common, the key which is used in the decrypting 
processing of the rewritten privileged ID information is the key which 
corresponds to the original key ID information, and accordingly, a decrypted 
result may become extraordinary. 

[0212] This embodiment will be described below with reference to the 
20 drawings. 

Fig. 47 is a conceptual view illustrating an overall arrangement of an 
updating system 3000 of this embodiment. 

As illustrated in this Figure, an updating system 3000 comprises a 
tag device 3010 such as a radio tag or the like which is applied to goods, a 
25 client apparatus 3020, a backend apparatus 3050 which controls products 

distribution information or the like which relates to ID in plain text, a security 
server 3060 which performs a re-privileging processing of privileged ID 
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information, and a security server 3070 which performs a restoration 
processing of ID. The client apparatus 3020, the backend apparatus 3050 and 
the security servers 3060 and 3070 are connected together to enable a 
communication therebetween through a network 3080 such as intemet or the 
5 like. For brevity of description, in this Figure, the tag device 3010, the client 
apparatus 3020, the backend apparatus 3050 and the security servers 3060 and 
3070 are each shown for only one, but it is to be noted that a plurality of tag 
devices are normally provided and that more than one client apparatus, 
backend apparatus and security servers may also be provided. In addition, the 

10 security servers 3060 and 3070 may be replaced by a security server which 
has the both functions of the security servers 3060 and 3070. 
[0213] In the client apparatus 3020 of this example, it reads privileged ID 
information from the tag device 10 and sends it to the security server 3070. 
The security server 3070 restores ID from the privileged ID information, and 

15 retums this ID to the client apparatus 3020. Upon receiving ID, the client 
apparatus 3020 accesses the backend apparatus 3050 to demand an entry of 
information including ID, a date and time of reading, a location of reading, a 
temperature or the like and an acquisition of information relating to ID. Also, 
a mode of utilizing a proxy model may be contemplated in which the client 

20 apparatus 3020 transmits the privileged ID information to the security server 
3070, which then directly accesses the backend apparatus 3050. 
[0214] At a given opportunity, the privileged ID information within the tag 
device 3010 is subjected to re-privileging processing in the security server 
3060 (namely, updating the privileged ID information into a separate 

25 privileged ID information), whereby the privileged ID information within the 
tag device 3010 is updated. In order to secure an opportunity to update the 
privileged ID information in a positive manner, the client apparatus 3020 may 
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be located at the porch of a house. In this instance, each time a user who 
carries the tag device passes through the porch, the client apparatus 3020 
reads the privileged ID information within tag device 3010, which is 
re-privileged by the security server 3060 to be written into the tag device 
5 again, 

[0215] The present embodiment is characterized in that the tag device 3010 
is provided with privileged ID memory including a read-only region in which 
key ID information is stored and a rewritable region in which privileged ID 
information is stored, and that while the re-privileged privileged ID 

10 information is written into the rewritable region, the read-only region in 

which the key ID information is stored is not updated. It is to be noted that the 
privileged ID information which is stored in the rewritable region does not 
contain key ID information. 

<functional arrangement/processing> 

1 5 Fig. 48 is an illustration of a functional arrangement of an updating 

system 3000 of the present embodiment, and Figs. 49 and 50 are flow charts 
for describing a processing procedure therefore. A functional arrangement and 
a processing of the present embodiment will be described below with 
reference to these Figures. A description of the backend apparatus will be 

20 omitted in connection Fig. 48 and subsequent Figures. The tag device 3010, 
the client apparatus 3020 and the security servers 3060 and 3070 execute 
respective processings under the control of controllers 3014, 3023, 3065 and 
3075, respectively. Data which are processed are sequentially stored in 
memories 3014a, 3023a, 3065a or 3075a, and is accessed when a processing 

25 such as a calculation is performed, but will be omitted from the description to 
follow. 

[02 1 6] <pre-processing> 
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In this mode, an encrypted text formed according to an encryption 
algorithm having the property of re-encryption (public key encryption 
technique) is used as privileged ID information. In this example, elliptical 
ElGamal encryption is used. 
5 As shov^n in Fig. 48, the tag device 3010 of this example has a 

confidential value memory 301 1 including a read-only region 301 la and a 
rewritable region 301 lb. As a confidential value memory 301 1, a rewritable 
memory such as rewritable ROM (Read Only Memory) such as EEPROM 
may be used, and given regions thereof may be allotted to the read-only 

10 memory 301 la and the rewritable region 301 lb. Alternatively, a memory such 
as ROM which cannot be rewritten may be used to construct the read-only 
region 301 la while a rewritable memory such as EEPROM may be used to 
construct the rewritable region 301 lb. Key ID information kidj which 
specifies a secret key skj and a public key pkj is stored (recorded) in the 

15 read-only region 301 la, and privileged ID information sidh=(g^ idh-pkj^) is 
stored in the rewritable region 301 lb. 

[0217] An element of generation g is stored in the memory 3065a of the 

security server 3060 ("updater"), and each key ID information 

(kidj, • kid„), a secret key (sk,, • sk„) and a public key (pk^, pk„) 

20 are stored in the key memory 3071 of the security server 3070 (equivalent to 
"decryptor") in a manner relating to each other. 

In this example, it is assumed that a total number m of tag devices is 
sufficiently greater than a total number n of keys (m»n), and an identical key 
ID information is allotted to unrelated tag devices. Specifically, rather than 

25 allotting an identical key ID information to tag devices which are applied to 
goods of the same variety, for example, an identical key ID information is 
allotted to tag devices which are applied to unrelated goods. This allows 
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preventing tag devices, the variety of goods or a particular one of goods from 
being uniquely identified on the basis of the key ID information. 
[02 1 8] <privileged ID decrypting processing> 

Initially, a decrypting processing of privileged ID information which 
5 is performed when demanding a backend apparatus 50 to acquire information 
relating to ID will be described- 

Initially, utilizing some sort of authentication technology, a mutual 
authentication is performed between the client apparatus 3020 and the 
security server 3070. It is to be noted that a communication between the client 

10 apparatus 3020 and the security server 3070 takes place by using an 
encryption according to some encryption technique. 

The client apparatus 3020 then transmits a read command to the tag 
device 3010 from its interface 3022 (step S501). This read command is 
received by an interface 3013 of the tag device 3010, and this triggers a 

15 read/write section 3012 to extract key ID information kidj from the read-only 
region 301 la of the confidential value memory 3011 and to extract privileged 
ID information sidh from the rewritable region 3011b (step S502). The 
extracted privileged ID information sidh and the key ID information kidj are 
transmitted to the client apparatus 3020 through the interface 3013 (step 

20 S503), and are received by the interface 3022 of the client apparatus 3020. 
The client apparatus 3020 identifies an address of the security server 3070 
from the received key ID information kidj, for example, and transmits the 
privileged ID information sidh and key ID information kidj to the security 
server 3070 from its communication section 3021 through a network 3080 

25 (step 504). 

[0219] The transmitted privileged ID information sidh and key ID 
information kidj are received by a communication section 3072 (equivalent to 
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"privileged ID input section") of the security server 3070 (accepted as inputs) 
(step S505), and the privileged ID information sidh is fed to a decryptor 74 
(equivalent to "ID calculator") while the key ID information kidj is fed to a 
read/write section 3073. The read/write section 3073 (equivalent to "key 
5 extractor") extracts a secret key skj which corresponds to the key ID 

information kidj which is sent thereto from a key memory 3071, and sends it 
to the decryptor 3074 (step S506). The decryptor 3074 calculates a tag ID 
information idh which is decrypted from the privileged ID information sidh 
using the privileged ID information sidh and the secret key skj which are sent 

10 thereto. In this example, the tag ID information idh is calculated by a 

calculation of idh=(idh'pHjO/(g')^^^- It is to be noted that the index "skj" in this 
calculation formula means "skj". The calculated tag ID information idh is sent 
to the communication section 3072, which then transmits it toward the client 
apparatus 3020 through the network 3080 (step S508). The client apparatus 

1 5 3020 receives the transmitted tag ID information idh at its communication 
section 3021 (step S509), and utilizes this tag ID information idh for a 
subsequent inquiry to the backend apparatus 3050. 
[0220] <privileged ID updating processing> 

Privileged ID information updating processing in the present 

20 embodiment will now be described. 

Initially, using some sort of authentication technology, a mutual 
authentication is made between the client apparatus 3020 and the security 
server 3060. It is to be noted that a communication between the client 
apparatus 3020 and the security server 3060 takes place in an encrypted form 

25 according to some encryption technique. 

Privileged ID information updating processing in this example is 
initiated at an arbitrary opportunity such as a passage of a user through a 
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location such as a front porch which he never fails to pass when leaving the 
house or at a number of uses of privileged ID information stored in the tag 
device 3010 (such as a count reaching a given value), which acts as a trigger. 
In response to this trigger, the client apparatus 3020 transmits a read 
5 command to the tag device 3010 from its interface 3022 (step S5 1 1). This 
read command is received by the interface 3013 of the tag device 3010, and 
this triggers the read/write section 3012 (equivalent to "privileged ID 
extractor") to extract key ID information kidj from the read-only region 301 la 
of the confidential value memory 301 1 and to extract privileged ID 

10 information sidh from the rewritable region 301 lb (step S5 12). The extracted 
privileged ID information sidh and key ID information kidj are transmitted 
(delivered) through the interface 3013 (equivalent to "privileged ID 
extractor") to the client apparatus 3020 (step S513), and are received by the 
interface 3022 of the client apparatus 3020, which then transmits the received 

15 privileged ID information sidh and key ID information kidj to the security 
server 3060 through the communication section 3021 and the network 3080 
(step 514). 

[0221] The security server 3060 receives (accepts as inputs) the privileged 
ID information sidh and the key ID information kidj at its communication 

20 section 3061 (equivalent to "privileged ID input section") (step S5 1 5), and 
sends the privileged ID information (sidh=(g^ idh'pkj^)) to the remainder 
multiplication calculator 3064 (which constitutes "privileged ID updating 
section"). The communication section 3061 (equivalent to "key extractor^') 
transmits this key ID information kidj together with a demand to acquire a 

25 public key to the security server 3070 through the network 3080. 

The security server 3070 receives them at its communication section 
3072, and sends the key ID information kidj to the reader 3073. The reader 
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3073 extracts a public key pkj which corresponds to this key ID information 
kidj from the key memory 3071, and retums the extracted public key pkj to the 
security server 3060 through the communication section 3072 and the 
network 3080. 

5 [0222] The security server 3060 receives (extracts) this public key pkj at its 
communication section 3061, and sends it to the remainder power calculator 
3063 (which constitutes "privileged ID updating section") (step S516). This 
triggers, for example, a random number generator 3062 to generate a random 
number r' which is equal to or greater than 0 and equal to or less than p-1 and 

10 to send it to the remainder power calculator 3063 (step S5 17). The remainder 
power calculator 3063 calculates (g'^ , pkj*^ ) using the element of generation g 
within the memory 3065a, the received public key pkj and the random number 
r', and sends a result of the calculation to the remainder multiplication 
calculator 3064 (step S518). The remainder multiplication calculator 3064 

15 calculates (g*^"^', idh'pkj'^'') using received (g"^ , pkj'^) and (g^ idh-pkj*^), and sends 
a result of this calculation (an encrypted text) as new privileged ID 
information to the communication section 3061 (step S519). The 
communication section 3061 (equivalent to "privileged ID output section") 
transmits (delivers) the privileged ID information (sidh'=(g'^% idh-pkj^^)) 

20 (privileged ID information sid', the association of which with the privileged 
ID information (sidh*) before updating is difficult to follow) to the client 
apparatus 3020 through the network 3080 (step S520). 
[0223] The transmitted new privileged ID information sidh' is received by 
the communication section 3021 of the client apparatus 3020, and is 

25 transmitted from its interface 3022 to the tag device 3010 (step S521). The tag 
device 3010 receives (accepts as input) this new privileged ID information 
sidh* at its interface 3013 (equivalent to "privileged ID input section") (step 
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S522), and its read/write section 3012 (equivalent to "privileged ID storage") 
stores this new privileged ID information sidh in the rewritable region 301 lb 
of the memory 3011 (step S523). The tag device 3010 responds with this new 
privileged ID information sidh* in response to a subsequent read demand. 
5 [0224] <features of embodiment 23> 

In the present embodiment, there is provided the confidential value 
memory 3011 having the read-only region 301 la in which key ID information 
is stored and the rewritable region 301 lb in which the privileged ID 
information is stored, and only the privileged ID information stored in the 
10 rewritable region 301 lb is re-privileged to be updated. Accordingly, if 
privileged ID information of a separate tag device were written into the 
rewritable region 3011b when re-privileging the privileged ID information, it 
is possible to detect such an irregularity/mistake. 

[0225] By way of example, referring to Fig. 48, an instance is considered in 
15 which privileged ID information (g", IDa'pk/) of a separate tag device which 
corresponds to key ID information kidi is stored in the rewritable region 
301 lb of the confidential value memory 301 1 of the tag device 3010. Even in 
this instance, key ID information which is stored in the read-only region 
301 la remains to be kidj, and the secret key which is extracted from the key 
20 memory 3071 by the reader 3073 during the decrypting processing of the 

security server 3070 is skj which corresponds to kidj. Accordingly, a result of 
decryption from the decryptor 3074 is (id2Tki')/(gT^^==(id2-(g'^')')/(gT^^= 
ID2"g^^Vg^'^^ whereby a result of calculation indicates an extraordinary data. 
Accordingly, a decrypted result represented by extraordinary data allows a 
25 detection of the fact that the privileged ID information of a separate tag 
device has been written into. 

[0226] Since a wrong rewriting of privileged ID information can be 
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prevented without a control as by password of an access to the rewritable 
region 30 lib, the cost for the control circuit can be suppressed while 
dispensing with a complex password control for purpose of an access control. 

Specifically, this enables an updating of privileged ID information at 
5 an arbitrary timing to be executed in a more reliable and safe manner and at a 
reduced cost, permitting a protection of the privacy of the tag device 3010. 

It is added that while privileged ID information is generated and 
updated using elliptical ElGamal encryption in the present embodiment, an 
encryption having the property of re-encryption or re-privileging technique 

10 disclosed in Patent Application No. 2003-359157 may also be used. In 

addition, the security servers 3060 and 3070 may be unified, and in addition, 
the security server 3060 may be provided with a memory for the public key. 
[0227] <Embodiment 24> 

The present embodiment is a modification of the embodiment 23, in 

15 which a confirmation is made to see whether or not a result of decrypting 
privileged ID information has any contradiction with the format of ID, 
thereby confirming whether or not privileged ID information which is 
delivered from the tag device is wrong. A distinction over the embodiment 
23 will be principally described below while omitting a description of matters 

20 which are common with the embodiment 23. 

Fig. 5 1 is an illustration of a functional arrangement of a security 
server 3170 (equivalent to "decryptor") of the present embodiment, and Fig. 
52 illustrates a format of tag ID information 3200 used in the present 
embodiment. Fig. 53 is a flow chart for describing a processing procedure by 

25 the security server 3 170. It is to be noted that functional arrangements which 
are common with the embodiment 23 are designated in Fig. 5 1 by like 
characters as used in the embodiment 23. 
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[0228] <an overall arrangement/ hardware arrangement> 

The arrangement is similar to the embodiment 23 except that the 
security server 3070 is replaced by the security server 3 170. 

<pre-processing> 

5 A distinction over the embodiment 23 lies in that an effective value 

of each field of ID is stored in an effective value memory 3 176 of the security 
server 3 170. In other respects, the process is similar as in the embodiment 23. 
[0229] <privileged ID decrypting processing> 

A distinction over the embodiment 23 resides in substituting a 

10 processing illustrated in Fig. 53 by the security server 3170 for the processing 
by the security server 3070 mentioned above (Fig. 49: steps S505 — S508). 
Only the processing by the security server 3 170 will be described below while 
omitting a description for other processing. 

In the similar manner as in the embodiment 23, privileged ID 

1 5 information sidh and key ID information kidj transmitted from a client 

apparatus 3020 are received by a communication section 3072 (equivalent to 
"privileged ID input section") of the security server 3 1 70 (accepted as inputs) 
(step S531) and the privileged ID information sidh is sent to a decrypting 
section 3074 (equivalent to "ID calculator") while key ID information kidj is 

20 sent to a reader section 3073. The reader section 3073 (equivalent to "key 
extractor") extracts a secret key skj which corresponds to the key ID 
information kidj which is sent thereto, and sends it to the decrypting section 
3074 (step S532). The decrypting section 3074 calculates the tag ID 
information idh which is decrypted from privileged ID information sidh using 

25 privileged ID information sidh which is sent thereto and the secret key skj. 
[0230] The calculated tag ID information idh is sent to an ID structure 
verifier 3177 where the structure of the tag ID information idh is verified (step 
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S534). As illustrated in Fig. 52, ID3200 of this example has fields including a 
header (h) 3210, a version code (vc) 3202, a manufacturer code (mc) 3203, a 
products code (pc) 3204 and a serial code (sc) 3205. An effective value which 
each field can assume is stored in an effective value memory 3 176, and the ID 
5 structure verifier 3 177 compares a value of each field in the received tag ID 
information idh against an effective value which is extracted from the 
effective value memory 3 176 to verify whether or not the value of each field 
in the received tag ID information idh is within a range for the effective value. 
Upon a successful verification (step S535), the ID structure verifier 3 177 

10 sends the tag ID information idh to the communication section 3072, which 
then transmits the tag ID information idh to the client apparatus 3020 (step 
S536). On the other hand, when the verification is unsuccessful (step S535), 
the ID structure verifier 3 1 77 destroys the tag ID information idh, terminating 
the processing operation. 

1 5 [023 1 ] <features of embodiment 24> 

In the present embodiment, an arrangement is made for the ID 
structure verifier 3177 of the security server 3170 to verify whether or not the 
decrypted tag ID information idh has no contradiction with a given ID format. 
This allows extraordinary which may result fi-om decrypting a privileged ID 

20 information which is attributable to a writing of privileged ID information of 
a different tag device into the rewritable region of the tag device to be 
discovered in a reliable manner. 
[Embodiment 25] 

The present embodiment is a modification of the embodiment 23, 
25 and a distinction over the embodiment 23 resides in that during a 

re-privileging processing of privileged ID information, a secret key is applied 
to the key ID information and re-privileged privileged ID information to 
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attach authentication information such as a digital signature, MAC or the like. 
A distinction over the embodiment 23 will be principally described below 
while omitting a description for other matters which are common with the 
embodiment 23. 

5 [0232] Figs. 54 and 55 illustrate functional arrangements of an updating 
system 3300 of the present embodiment, and Figs. 56 and 57 are flow charts 
for describing a processing procedure. It is to be noted that in Figs. 54 and 55, 
functional arrangements which are common with the embodiment 23 are 
designated by like characters as used in the embodiment 23. 

10 <an overall arrangement/ hardware arrangement> 

The arrangement is similar to the embodiment 23 except that a tag 
device 33 10 is substituted for the tag device 3010, a security server 3360 
(equivalent to "updater") is substituted for the security server 3060, and a 
security server 3370 (equivalent to "decryptor") is substituted for the security 

15 server 3070. 

[0233] <pre-processing> 

Distinctions over the embodiment 23 reside in that privileged ID 
information sidh and a digital signature (equivalent to "verification 
information") are stored in a rewritable region 3311b of a confidential value 

20 memory 3311 of the tag device 33 10 and that the secret key skj and the public 
key pki used in the digital signature are stored in a key memory 3366 of the 
security server 3360. In other respects, the arrangement is similar to the 
embodiment 23. 

<privileged ID updating processing> 

25 Privileged ID information updating processing of the present 

embodiment will now be described. 

[0234] Initially, a client apparatus 3020 transmits a read command to the tag 
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device 33 10 from its interface 3022 (step S541). The read command is 
received by an interface 3013 of the tag device 3310, and this triggers a 
read/write section 3012 to extract key ID information kidj from a read-only 
region 301 la of the confidential value memory 3311 and to extract privileged 
5 ID information sidh from the rewritable region 33 1 lb (step S542). The 
extracted privileged ID information sidh and key ID information kidj are 
transmitted to the client apparatus 3020 through the interface 3013 (step 
S543), and are received by the interface 3022 of the client apparatus 3020. 
The client apparatus 3020 transmits the received privileged ID information 

10 sidh and key ID information kidj to the security server 3360 through a 
communication section 3021 and a network 3080 (step 544). 
[0235] The security server 3360 receives the privileged ID information sidh 
and the key ID information kidj at its communication section 3061 (step 
S545), and sends the privileged ID information (sidh=(g^ idh-pkj^)) to a 

15 remainder multiplication calculator 3064. In the similar as in the embodiment 
23, the communication section 3061 transmits the key ID information kidj to 
the security server 3370 where the extracted public key pkj is acquired 
(received) (step S546). This public key pkj is sent to a remainder power 
calculator 3063, and a random number r' which is generated in a random 

20 number generator 3062 (step S547) is also sent to the remainder power 

calculator 3063. The remainder power calculator 3063 calculates (g , pkj ), 
and sends a result of calculation to the remainder multiplication calculator 
3064 (step S548), which then calculates (g^"", idh-pkj'^''), and sends this result 
of calculation as new privileged ID information to the communication section 

25 3061 and a signature generator 3368 (step S549). This triggers a reader 3367 
to extract a secret key sk from the key memory 3366 and to send it to the 
signature generator 3368 (step S550). The signature generator 3368 
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(equivalent to "verification information generator") also receives the key ID 
information kidj from the conmiunication section 3061 to generate a bit 
combination data (g*^*" | idh-pkj'^'' | kidj) of g*^*", idh-pkj'^'^ and kidj, for 
example, and generates a digital signature (equivalent to "verification 
5 information") a -Esk(g'^' | idh'pkj'^"' | kidj) which is formed by encrypting the 
bit combination data with the secret key sk (step S551). The generated new 
digital signature a' is sent to the communication section 3061 (equivalent to 
"privileged ID output section"), which transmits (delivers) the new privileged 
ID information (sidh -(g'^^, idh-pkj'^'')) which is previously sent thereto and the 
10 new digital signature a' to the client apparatus 3020 through the network 3080 
(step S552). 

[0236] The new privileged ID information sidh' and the digital signature & 
which have been transmitted are received by the communication section 3021 
of the client apparatus 3020 and are transmitted from the interface 3022 to the 

15 tag device 3310 (step S553). The tag device 3310 receives (accepts as inputs) 
the new privileged ID information sidh' and the digital signature a' at its 
interface 3013 (equivalent to "privileged ID input section") (step S554), and 
the read/write section 3012 (equivalent to "privileged ID storing section") 
stores the new privileged ID information sidh' and the digital signature a' in 

20 the rewritable region 33 1 lb of the confidential value memory 3311 (step 

S555). Subsequently, the tag device 3310 responds with the new privileged ID 
information sidh' and the digital signature & in response to a read demand, 
[0237] <privileged ID decrypting processing> 

Privileged ID information decrypting processing according to the 

25 present embodiment will now be described. 

Initially, the client apparatus 3020 transmits a read command to the 
tag device 3310 from its interface 3022 (step S561). This read command is 
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received by the interface 3013 of the tag device 33 10, and this triggers the 
read/write section 3012 to extract key ID information kidj from the read-only 
region 301 la of the confidential value memory 33 1 1 and to extract privileged 
ID information sidh and digital signature a* from the rewritable region 3311b 
5 (step S562). The extracted privileged ID information sidh*, digital signature a* 
and key ID information kidj are transmitted to the client apparatus 3020 from 
the interface 3013 (step S563), and are received by the interface 3022 of the 
client apparatus 3020. The client apparatus 3020 transmits such information 
from the communication section 3021 to the security server 3370 through the 
10 network 3080 (step 564). 

[0238] The transmitted privileged ID information sidh', digital signature a' 
and key ID information kidj are received by the communication section 

3072 (equivalent to "privileged ID input section") of the security server 3370 
(accepted as inputs) (step S565), the digital signature o' is fed to a signature 

15 verifier 3376, the privileged ID information sidh is fed to a decryptor 3074 

(equivalent to "ID calculator") and the signature verifier 3376, and the key ID 
information kidj is fed to a reader 3073 and the signature verifier 3376. 

The communication section 3072 also sends a public key acquisition 
demand to the security server 3360 through the network 3380, and the 

20 security server 3360 receives it at its communication section 3061 and causes 
its reader 3367 to extract the public key pk from the key memory 3363 and 
returns the public key pk through the communication section 3061 and the 
network 3080. The public key pk is received by the communication section 
3072 of the security server 3370 (step S566) and is then sent to the signature 

25 verifier 3376. 

[0239] The signature verifier 3376 decrypts the received digital signature & 
using the public key pk (Dpk(a*)), and generates a bit combination data (g*^*" | 
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idh'pkj"^''' I kidj) of g"^" , idh-pki""^" and kidj. It then verifies the digital signature 
a' by seeing whether or not Dpic(a') is equal to (g*^*^^ | idh pkj'^'^^ | kidj) (step 
S567). In the event Dpk(a')=(g'^'' | idh pkj'^'' | kidj) does not apply, the 
processing is terminated as a failure of verification. On the other hand, if 
5 DpkCo^^Cg*^^ I idh-pkj^'^ I kidj) does apply, a read/write section 3073 

(equivalent to "key extractor") extracts a secret key skj vs^hich corresponds to 
the key ID information kidj which is sent thereto from a key memory 3071, 
and sends it to the decryptor 3074 (step S568). Using the privileged ID 
information sidh) and the secret key skj which are sent thereto, the decryptor 

10 3074 calculates tag ID information idh which is decrypted from the privileged 
ID information sidh* (idh=(idh pkj'^0/(g "^O'^O) (step S569). It is to be noted 
that the index "skj" appearing in this calculation formula refers to "skj". The 
calculated tag ID information idh is sent to the communication section 3072, 
which then transmits it to the client apparatus 3020 through the network 3080 

15 (step S570). The client apparatus 3020 receives the transmitted tag ID 

information idh at its communication section 3021 (step S571), and utilizes 
this tag ID information idh in its subsequent inquiry to the backend apparatus 
3050. 

[0240] <features of embodiment 25> 

20 In this embodiment, an arrangement is made that during 

re-privileging processing, a digital signature a -Esk(g^^ I idh-pkj*^*^ | kidj) is 
generated in the security server 3360, and this digital signature & is verified 
by the security server 3370 during the decrypting processing- Accordingly, 
during the decrypting processing, the authenticity of privileged ID 

25 information which is re-privileged can be verified by the digital signature, 
allowing a storage of a wrong privileged ID information in the tag device 
33 10 to be detected in a more reliable manner. 
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[0241] While the digital signature a* is generated in the security server 3360 
in this mode, it is to be noted that the security server 3370 or a server of an 
authentication organization or the like may act for the generation of the digital 
signature g\ 
5 [Embodiment 26] 

This embodiment is a modification of the embodiment 23, and differs 
from the embodiment 23 in that of a variety of information which constitute a 
tag ID information, only that information which is inherent to each tag device 
is privileged to provide privileged ID information. A distinction over the 
10 embodiment 23 will be principally described below while omitting a 
description for matters which are common with the embodiment 23. 
[0242] Fig. 58 is an illustration of a functional arrangement of a tag device 
3410 of the present embodiment. It is to be noted that in Fig. 58, functional 
arrangements which are common with the embodiment 23 are designated by 
15 like characters as used in the embodiment 23. 

<an overall arrangement/hardware arrangement> 
This remains to be similar to the embodiment 23 except that the tag 
device 3010 is replaced by a tag device 3410. 
<pre-processing> 

20 A distinction over the embodiment 23 resides in that of a variety of 

information which constitute tag ID information, only that information which 
is inherent to each tag device is privileged to provide privileged ID 
information sidh. When using tag ID information having a data construction as 
illustrated in Fig. 52, the serial code (sc) 3205 represents information which is 

25 inherent to each tag device, and privileged ID information will be sidh=(g^ 
sch pkj*^). This privileged ID information (sidh=(g^ sch pkj'^)) is stored in a 
rewritable region 341 lb of a confidential value memory 341 1 of the tag 
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device 3410. It is also a distinction over the embodiment 23 that infomiation 
which is common to products such as the version code (vc) 3202, 
manufacturer code (mc) 3203 and products code (pc) 3204 are encrypted 
(E(vc), E(mc), E(pc)) and stored in a read-only region 341 la of the 
5 confidential value memory 341 1 . It is to be noted that a probability encryption 
or the like is used for encrypting information such as version code (vc) 3206 
or the like which is common to every kind of products so that a different 
encrypted text may be obtained for the same products, 
[0243] <processing> 

10 Privileged ID decrypting processing and privileged ID updating 

processing of this example remain similar to the embodiment 23 except that 
the privileged ID information is represented by sidh=(g^ sch pkj"^). It is also 
another difference from the first mode that a read/write section 3012 extracts 
E(vc), E(mc), E(pc) or the like from the read-only region 341 la of the 

15 confidential value memory 341 1 to be transmitted to a backend apparatus 
3050 though its interface 3013 and client apparatus 3020 or the like as 
required for an inquiry to the backend apparatus 3050. 
[0244] <features of embodiment 26> 

In the present embodiment, since only information which is inherent 

20 to each tag device is privileged to provide privileged ID information, an 

amount of data which is subject to the privileging processing can be reduced 
to reduce the amount of calculation and amount of communication in 
comparison to an arrangement in which information which is common to each 
kind of products is also privileged to provide privileged ID information. 

25 It should be understood that the present embodiment is not limited to 

the described modes or embodiments mentioned above. By way of example, 
the present invention can be carried out in a mode which comprises a 
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combination of embodiments, and in addition, a variety of processings 
mentioned above are not limited to those which are executed in a time 
sequence as described, but may be executed concurrently or individually 
depending on the processing capacity of the apparatus which executes a 
5 processing or as required. In addition, it should be understood that 

modifications can be suitably made without departing from the spirit of the 
present invention. 

[0245] When the described arrangements are implemented using a computer, 
a processing content of a function which is to be performed by each apparatus 

10 is described in terms of a program. By executing the program on a computer, 
the processing function is implemented by the computer. 

The program which describes such processing content can be 
recorded in a record medium which is readable by the computer. A record 
medium which is readable by the computer may comprise a magnetic recorder, 

15 an optical disc, a magneto-optical record medium, a semiconductor memory 
or the like, for example. Specifically, by way of example, the magnetic 
recorder may comprise a hard disc unit, a flexible disc, a magnetic tape or the 
like; an optical disc may comprise DVD (Digital Versatile Disc), DVD-RAM 
(Random Access Memory), CD-ROM (Compact Disc Read Only Memory), 

20 CD-R (Recordable) / RW (Rewritable); the magneto-optical record medium 
may comprise MO (Magneto-Optical disc) or the like; and the semiconductor 
memory may comprise EEP-ROM (Electronically Erasable and 
Programmable-Read Only Memory) or the like. 

[0246] The distribution of the program may take place through a sale, a 
25 transfer or a lease or the like of a portable record medium such as DVD, 
CD-ROM or the like in which the program is recorded. Alternatively, the 
program may be stored in a memory of a server computer, and may be 
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transferred from the server computer to another computer for purpose of 
distribution. 

A computer which is used to execute the program may have the 
program which is recorded in the portable record medium or the program 
5 which is transferred from the server computer once stored in its own memory. 
When the processings are to be executed, this computer can read the program 
stored in its own record medium and executes processings in accordance with 
the program which is read out. In another mode of executing the program, the 
computer may directly read the program from the portable record medium, 

10 and then execute processings in accordance with the program. In addition, 

each time a program is transferred from the server computer to this computer, 
the computer may execute processings in accordance with the program 
received in a sequential manner. As a fiirther altemative, rather than 
transferring the program from the server computer to this computer, the 

15 described processings can be executed by a so-called ASP (Application 

Service Provider) service in which the processing fimctions are realized by 
merely commanding execution and acquiring results. It is to be understood 
that a program in this mode is intended to include information which is used 
in a processing by an electronic computer and which conforms to a program 

20 (such as data which does not directly command a computer, but which has the 
property to rule the processing by the computer). 
AVAILABILITY OF USE IN INDUSTRY 

[0247] In accordance with the present invention, a likelihood that a 
distribution process of tag devices may be traced from information delivered 
25 from tag devices in RFID, for example, can be suppressed. 



